How to output correctly an html_restricted textarea field in Twig?
The Drupal 8 way would be to use a view mode and let the field formatter do its work.

If you want to do this in custom code you can build the render element for processed text like you did in the question, but use the text format stored in the field:

$user['bio'] = [
  '#type' =&gt; 'processed_text',
  '#text' =&gt; $data[0]['value'],
  '#format' =&gt; $data[0]['format'],
];


Then you are sure, that the text filters are applied configured in the format, that the user who filled in the text field had permission to use.

To output the variable in twig you don't need any filters, they are applied automatically by the render element:

{{ user.bio }}




Edit for the question in the comment, how to render a field without a view mode. There is a way to do this. You can view a field by providing the display options in an array:

$user['bio'] = $journalist-&gt;field_bio-&gt;view(['label' =&gt; 'hidden', 'type' =&gt; 'text_default']);


But this is as expensive as rendering the complete entity and is not optimized for caching. So use it only if you can't figure out a way how to render whole entities in view modes.