> HTMLX uses innerHTML/outerHTML extensively, meaning that XSS is a real concern.

It's the same kind of a concern as having a user input inside HTML served from a server in the first place. And typical backend frameworks people would use with HTMX are already good at mitigating XSS inside served HTML.