Yes, although a slightly more relevant way of putting it would be that it's an inbuilt DOMPurify (dompurify being an npm package commonly used to sanitize html before injecting it).
I obviously know nothing about this, but I still find it fascinating. Or am I off my block.
https://developer.mozilla.org/en-US/docs/Web/Security/Attack...