@eddieajau asked that I raise this issue with the CMS.

joomla/joomla-platform#769 (comment)

In the "Deprecate JView::escape()" pull request, it was proposed that the escape method be deprecated. I agreed, primarily on the basis that JView scope limits it's usefulness to Component Views. Further, I pointed out that no module output is escaped in Joomla core and I wonder if it's related to the lack of availability of this method.

IMO, it would make sense to either remove the method from JView, or relocated it where frontend devs can use it in all rendered output, including components, but also templates and modules.

Regardless, module output should be escaped. If the JView::escape method cannot be used, using PHP methods is sufficient, but it really should be done.

http://shiflett.org/blog/2005/feb/my-top-two-php-security-practices