Escape markup so it renders as text, or decode entities back, with an option to escape every non-ASCII character for older pipelines.
The result appears hereAmpersand, less than and greater than always, plus the quote marks inside an attribute. Those five are what separate text from markup; everything else is optional.
When the output travels through something that is not UTF-8 clean, such as an old email template or a legacy CMS field. On a modern page it only makes the source harder to read.
Escaping is the right idea, but do it where the value is rendered, with your framework's own escaping, rather than by hand up front. React escapes text nodes for you; the hole is always the place that opts out.