Problem: Section names in Special:Preferences aren't escaped.
Solution: Escape them in HTMLForm.php line 1820:

return $this->msg( "{$this->mMessagePrefix}-$key" )->escaped();

There is somewhat of a backwards compatibility problem here. We don't know if anything is relying on legend being raw html. We need to make sure we are consistent with https://www.mediawiki.org/wiki/Deprecation_policy. Notwithstanding that, we really do need to fix this.

Maybe setting it to ->parse() would reduce the backward compat risk, as it would allow safe html through well banning unsafe.

Problem: Months abbreviation aren't escaped, tested in Special:AbuseLog and Special:CheckUser at least
Solution: Escape message in language.php at line 909:

return $this->msg( $msg )->escaped();

I actually think here that it should be the responsibility of the person using these methods to escape it. We don't know if the month name is ultimately destined for html, or maybe somewhere else where html is no supported. (The notable exception, is in commaList and friends we do escape the comma, as often that is used to combine html snippets)

Problem: group-*-member messages aren't properly escaped in logs and user rights pages
Solution: Escape the message in UserGroupMembership.php line 449:

return $msg->isBlank() ? $group : $msg->escaped();

Similarly, sometimes this needs to be non-html escaped depending on where the group name is destined to. Part of the problem here is that phan is not smart enough to understand how this code block is working. See T183174

Could we determine what is causing such problems with the first point? And, for the other ones, do this means that escaping should be done properly for every use case?

Anyway, I think we should fix escaping for 1 and 2 where mentioned in task description (logs and special:userRights for 1, special:abuselog and special:checkuser for 2): it's actually possible to inject custom JS there.

Yes, they definitely need to be escaped, just as near to the output as possible

I accidentally rediscovered your problem #3 and fixed it in https://gerrit.wikimedia.org/r/c/mediawiki/core/+/457551 before finding this task. (I made it escape in SpecialPreferences.php. It seems HTMLForm::getLegend() should really return plain text, and its return value is being escaped elsewhere.)