@Anton Yes. Since your app can’t control every write to the product description, I’d treat both product.description and Storefront API descriptionHtml as untrusted. You can pass product.description to JavaScript with {{ product.description | json }}, sanitize it, then render the sanitized result. You can take a similar approach to Storefront API’s descriptionHtml.
Because storefront performance matters, I’d say the ideal solution is to prevent unsafe input at the point of entry rather than require each renderer to sanitize it. I’ll submit a feature request to strengthen platform-wide protections against unsafe input. I’ll also share your feedback that the docs should make it clearer when values aren’t sanitized.