If I were a hacker with access to the database, wouldn’t I just add my
code to a post’s content?
If you’ve got access to the database, chances are that you’ve got enough access that escaping isn’t going to stop you. Escaping is not going to help you if you’ve been hacked. It’s not supposed to. There’s other reasons to escape. The two main ones that I can think of are:
To deal with unsanitized input
WordPress post content is sanitized when it’s saved, but not everything else is. Content passed via a query string in the URL isn’t sanitized, for example. Neither is content in translation files, necessarily. Both those are sources of content that have nothing to do with the site being compromised. So translatable text and content pulled from the URL need to be escaped.
To prevent users accidentally breaking markup
Escaping isn’t just for security. You also need it to prevent users accidentally breaking their site’s markup. For example, if the user placing quotes or > symbols in some content in your plugin would break the markup, then you should escape that output. You don’t want to be over-aggressive in sanitising on input, because there’s perfectly valid reasons a user might want to use those characters.
“Escaping isn’t only about protecting from bad guys. It’s just making
our software durable. Against random bad input, against malicious
input, or against bad weather.”
That’s from the WordPress VIP guidelines on escaping. It has a lot more to say on this matter, and you should give it a read.