I’ve seen this issue before and it’s related to the go html/template package:
html/template
What I found is that If you minify your site with hugo --minify the attributes are unescaped.
hugo --minify