The question is not how mitigate vulnerability. Every vulnerability is trivially easy to mitigate.

The question is whether it's easy to write vulnerable code.

For PHP it's easy and implicit:

    <div><?= some_expression ?></div>

For React it's hard and explicit:

    <div dangerouslySetInnerHTML={{ __html: someExpression }} />