How to securely set dynamic HTML content with JavaScript?

Using wp_kses_post to escape the texts before setting them in wp_add_inline_script is a good approach to prevent malicious content from being added to the page. This will ensure that the text is properly sanitized and only contains allowed HTML tags and attributes.

If you want to allow certain HTML tags and attributes, you can use wp_kses instead of wp_kses_post and pass an array of allowed tags and attributes as a second argument.

Using element.innerHTML to set the contents of the elements is generally safe, as long as the content being set has been properly sanitized. In this case, since you are using wp_kses_post (or wp_kses with an appropriate set of allowed tags and attributes) to sanitize the text, it should be safe to use element.innerHTML.