Thanks for the reply.
All translation fields are escaped too.
I can’t work out, if because I’ve now used a variable ( $output ) that contains HTML, that $output itself, now needs to be escaped? If that’s the case, it would explain they say do a global search for ‘echo $’. Confused!