The footnotes text format has more limited allowed html, but whatever html was provided by it was copied into the data-* attribute of the footnote in the parent text format. Users without 'Limit allowed html' enabled should either enable that or update to beta7 if untrusted users are adding footnotes or pasting from untrusted sources.
Raw is avoided in default twig templates, the footnote text is converted to a markup object so it renders properly without raw