Yes, but terminal escape sequences are a very, very small surface. It's just a few opcodes like "wipe screen", "switch to buffer B", "move to X,Y". All process output regardless of whether it is a terminal escape sequence or regular text just navigate and update the screen "cells", and in, say, alacritty this will be in boring, non-unsafe Rust.

For comparison, the surface exposed by your browser rendering this text controlled entirely by an adversary (me) is considerably greater as it also interacts with the style system, content reflow, javascript engine (even for non-javascript websites), etc.