some helpers produce escaped output, some don't.
Think: "link_to(name, url)" must produce html that must not be escaped again while "strip(text)" can produce unescaped text.
PHP's number_format() doesn't escape for HTML - is that an XSS bug too?
Here's the version for use in a view context: https://github.com/rails/rails/blob/master/actionview/lib/ac...
You can see that this method has some XSS prevention logic.
Here's the converter itself: https://github.com/rails/rails/blob/master/activesupport/lib...
I can't look at the diff for some reason (too many redirects), but I'd guess this issue was the result of some logic that was implemented before SafeBuffers were added.