The Search documentation on Security says it plainly:
https://fomantic-ui.com/modules/search.html#/security

The default (thus omitted) setting preserveHTML:true in the first example results in instantly getting an alert message
It also injects hidden code into an additional click event handler on a search item (marked red).

Fomantic-UI should be safe and secure out of the box, and promote secure coding practices, as well as document them.

preserveHTML should be set as false by default. Developers should knowingly and purposefully set it to true, after they have considered the implications and made sure that the data they inject is indeed secure with strings properly escaped.

This would be a breaking change, as websites may depend on the current preserveHTML default value. However, it should be set to false, and a proper advisory (release note) given.

I can prepare a PR for code and documentation if this move is agreed in principle.