Why doesn't DOM API escape content in ${"XXX"}