Why would you use esc_attr() on internal functions?
You probably wouldn’t. If you did it would be to make sure it was in place already if in future you decided to make the variable dynamic or filterable.
In this case I would suggest it for similar reasons to #1. You may know where $class is coming from now, but this may change in future, and it prepares the function for potential use in different contexts where $class may not be controlled.
You need to escape here because you know for certain that your code has no control over what the value of $class may be, and you should make sure that your code does not break if an improper value is passed. This is not solely a security concern. As you will learn from following questions on this site, many developers who use filters do not necessarily know what they are doing. They may write code that takes a dynamic value and adds it as a class using your filter. Most of the time this might be fine, but what if they are automatically pulling something in like a post title? Eventually there may be a post title with a " character, and this will break the markup of their site if you do not escape the values from that filter. An experienced developer would know what the problem is and escape it themselves, but not all developers who might use your filter are quite as experienced.
