Oh, its the wp_kses_post() that does this. 🙁

Hmmm ...
for now I rewrote it like this:
echo apply_filters( 'the_content', wp_kses_post( $content_markup ) );
Which I think is correct escaping for this situation, but phpcs still reports it as unescaped :/

Anyhow ... thanks again.