I think what they mean is that methods like add_header and add_text actually take raw HTML as an argument, which means that if you want to add arbitrary text, you actually need to do

    import html

    ...

    card.add_text(html.escape(my_text))