Unexpected esc_html and esc_attr behaviour

Use get_search_query or the_search_query to return/output the search term as a properly escaped value, don’t access $_GET directly. You’re trying to escape something that’s already URLencoded.