It is the right defence for one context — text inside an element body or a quoted attribute — but not universally. Content going into a <script> block, an inline event handler, a URL attribute or a CSS value each needs its own escaping rules. Escaping for the wrong context is a well-known way to produce a vulnerability that looks defended.
Which characters actually need escaping?
Five: & < > " and '. Escaping the whole non-ASCII range is available but rarely useful on a UTF-8 page — it inflates the output several times over for no security benefit, since a UTF-8 document can carry é and 日本語 directly.