> maybe third time could be the charm: it's for preventing XSS holes

That information is in the question, so sadly no this still doesn't make sense to me because I don't understand any scenario in which this is what the developer wants. You always still need more code (to filter the right tags) or can just use textContent (separating data and code completely, imo the recommended solution)

> Maybe you meant .innerHTML? .innerText AFAIK doesn't try to parse HTML (why would it?)

No, I didn't mean that, yes it does, and no I don't know why it is this way. If you don't believe me and don't want to check it out for yourself, I'm not sure what more I can say

> I don't understand any scenario in which this is what the developer wants.

Client-side includes.