Can you clarify? What exactly do you mean by escaping output, and how can forgetting that cause a security issue?
Would you like to contact ${NAME}?
Where ${NAME} is a user supplied parameter (you ask them what their name is)
Let's say I entered my name as: <script>/evil code/</script>
Now, if the output isn't escaped the page reads:
Would you like to contact <script>/evil code/</script>?
You've just injected evil code into the website that will be executed every time my user profile page is visited by another user.
EDIT: Hacker news doesn't properly render javascript comments.
You can try to filter for anything that may be potentially dangerous, but that's going to make a very long list of invalid inputs and once again you're playing whack-a-mole, hoping you correctly sanitize your input for all potential output contexts (unless you go through and re-sanitize all your user data whenever you add a new output context, which is a bit absurd).
From a programming perspective, it's akin to a function not checking that the input it has received is valid (because the caller is always going to do that...).
Then what happens when you want to use that input in an excel export? PDF export? CSV file? Text file? How about if you want to use it in an HTML attribute? In a URL? Export the database elsewhere? (Such as a credit card company reporting to the CSAs). You can't assume that your data is going to be inside an HTML page between tags always because that mucks up your data. Data should be able to be used in many different ways because it will be and should not be tied to HTML.
If you want to see specific examples, search for how to avoid XSS attacks. Any decent guide will focus on escaping, not sanitisation.
I did get my answer, though -- output matters because it might be a different medium than input. So even if you sanitize HTML input, malicious VBA code could make it through that eventually ends up in an Excel report and gets executed (for example).