The Underscorejs output escaping sniff checks for <%=, but it's possible that <%= _.escape(...) would also sufficiently escape the output.

I don't know UnderscoreJS, so this needs looking into, but it may help remove some false positives.