In order to allow "bad" sequences like "-->" in comment data, the contents of a CommentNode should have HTML entities unescaped for display, and then escaped before serialization.
See T95039 for more details and context.
Concretely, a wikitext comment like:
<!-- hello & --< bad contents, dude! -->
will be represented by Parsoid in its DOM as:
<!-- hello & --< bad contents, dude! -->
But the DOM CommentNode#data property gives the raw DOMString. The HTML entities need to be manually unescaped before displaying the comment contents to the user, and then the characters -, >, and & must be entity-escaped before giving any edited comment contents to document.createComment.
(Note that - is usually considered an HTML-safe character, and may not be escaped by a standard minimal entity encoder.)