That's the whole point of the setHTML.
How would I set a header level using textContent?
The traditional way: separating data and code
document.createElement("h1").textContent = `Hello, ${username}!`
The traditional way: separating data and code
If you allow <h1> in the setHTML configuration or use the default, users with the tag in their username also always get it rendered as markup