vs WordPress Security

In the articles case, $title is an arbitrary value, as such it should be escaped via html, but, if it was gotten from a WordPress core function it is probably safe, but you should check anyway

For example, get_the_title() can contain html markup and is not escaped by default.

Eitherway post and page titles should not have html in them. Styling is for themes, not for content.

You should validate all data at entry, and that is where you should focus your efforts. What your doing improves your security but by how much depends on where the data is coming from.

I recommend you escape all data on input and output, but do it out of habit rather than for specific exceptional cases