This works perfectly for me:

function helpme() {
  var template = HtmlService.createTemplate('<?= foo ?>');
  template.foo = '<h1>Hello World Again!</h1>';
  var html=template.evaluate().setSandboxMode(HtmlService.SandboxMode.IFRAME);
  SpreadsheetApp.getUi().showSidebar(html);
}

I’m using this code from a course on Udemy. When it runs I get this on the side bar in sheets:

<h1>Hello World Again!</h1>

Of course I don’t want the HTML, but I can’t figure out what’s up. Here is the code:

var template = HtmlService.createTemplate('<?= foo ?>');
  template.foo = '<h1>Hello World Again!</h1>';
  Logger.log(template.evaluate().getContent());  // will log 'Hello World!'
  var html = template.evaluate().setSandboxMode(HtmlService.SandboxMode.IFRAME);
  SpreadsheetApp.getUi().showSidebar(html);

In the video in the course, he doesn’t get it. It works perfectly. I usually type everything in myself, but this is copied from the course.