The simple answer appears to be human error. Originally, during development, Twenty Twenty One had one menu, registered like this:
'primary' => __( 'Primary Navigation', 'twentytwentyone' ),
Then somebody went through and added escaping to many __() throughout the theme, resulting in this:
'primary' => esc_html__( 'Primary Navigation', 'twentytwentyone' ),
Then, later on, a second menu was added, like this:
'primary' => esc_html__( 'Primary Navigation', 'twentytwentyone' ),
'footer' => __( 'Footer Navigation', 'twentytwentyone' ),
And nobody seems to have noticed the discrepancy.
It’s often considered best to escape “late”, as described in this WordPress VIP article. That is, as close to output as possible. So it’s important to note that these lines are not outputting anything. They are just defining the strings to be output later. However, this is where WordPress outputs these values:
<label for="locations-<?php echo esc_attr( $location ); ?>"><?php echo $description; ?></label>
Note that $description, which is the menu name, is not escaped. Therefore, since editing WordPress core is not an option, it would be considered best practice to escape the menu name when registering it.
So should the secondary menu be escaped. Yes. Is it? No. Why? Human error.