Formatting of formatted text in print case and activiy audit
I see - a custom field, not the main details field.

A couple things I think. There is a security issue with not escaping the fields, so in that sense it is being correct to escape the brackets etc, but better would be some type of sanitizing that leaves formatting but removes malicious parts. I'm not sure if this is the job of the wysiwyg editor itself or the civi code that handles the data.