It is worse than useless because it makes you think you are secure.

XSS attackers are more likely to generate arbitrary requests to secure endpoints as you via JS than they are to send the cookie to themselves at 3AM so they can rush to craft requests.

And httponly does didly squat to prevent that.

Better is to focus entirely on santizing your output properly in the context it is outputted. And use whitelists, never blacklists.