Drupal 7 was not inherently vulnerable to XSS attacks but made it easy for novice developers to open such vulnerabilities. The PHP-based templating system, in particular, made it easy for developers to forget to properly sanitize user input and any other kind of data before outputting it. Moreover, it allowed novice developers to perform all kinds of business logic directly in the template. Apart from not keeping a separation of concerns (business logic versus presentation), this also meant that third-party themes were much more difficult to validate and could easily include security holes.
Most of these concerns have been addressed in Drupal 8, in principal with the adoption of Twig as the templating system. There are two main consequences of this adoption. The first one addresses the need for separating presentation from business logic. In other words...