Would it help if we changed the (server-side) escaping of these macro marker comment contents to use HTML escaping?

Not sure how it would help: here's the escaping is done entirely in frontend, when the request is sent the element are already removed. See my comment: https://jira.xwiki.org/browse/XWIKI-21866?focusedId=116717&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-116717