W3Schools is not responsible for what devs do, and safe code means introducing more concepts that can leave the scope of a tutorial.
I agree the code sucks, but we're talking about minimizing time to understand something, not security. Save that for the security tutorials.