This fix was made at version 0.9 (if I read it correctly). When doing a "getpeerlist" on my own client (or visiting CraigWatson's status page), I see some clients still having <0.9.
I think htmlspecialchars() shouldn't hurt. It's better than potentially endangering webmasters who integrates the status page on a <0.9 node.