&gt; yes, API takes strings, but it calls native DOM at the end anyway<p>jQuery calls <i>unsafe API</i> which should only be handled <i>trusted strings</i> but makes it easy and convenient to give them <i>untrusted string</i> and thus introduce <i>exploit vectors</i>.<p>Furthermore it&#x27;s also significantly more difficult to <i>audit the code</i>, using the regular DOM there are only a pair of attributes to check, whereas pretty much <i>any jQuery method call</i> is a potential security hole.<p>tldr: jQuery makes doing things wrong very easy, much easier than doing things right.