You do get XSS protection out of the box in most templating languages, though, and PHP is also a templating language.

Take this template:

  <h1>{{ title }}</h1>

In most templating languages, for a title of "<script>alert();</script>", the result will end up being:

  <h1>&lt;script&gt;alert();&lt;/script&gt;</h1>

In PHP, which is a templating language, the equivalent seems to be:

  <h1><?php echo $title; ?></h1>

But this will print the title unescaped, which is a security vulnerability, and incorrect. In reality, the equivalent is:

  <h1><?php echo htmlspecialchars($title); ?></h1>

Now, you could say, don't use PHP as a templating language! But if you're not supposed to use PHP as a templating language, why does it behave as one? This is one of PHP's footguns to be avoided. Personally, I recommend a linter like PHPCS to catch issues like this one.

Well, of course not from any lang that treats HTML as a string, but there are langs, which treat HTML as structured data, in their standard libraries. Take a look at SXML libraries for example. Whatever script you stored as a username for example, it would still get treated as text, not tag, when put into lets say a span or p. SXML is aware of the boundary between tags, their attributes and their content.