Pretty much the case. Because Gossamer Links doesn't escape all variables passed into the template parser (we would like to change this, but it would likely break a lot of plugins, templates, etc - most of our other products do it already), you need to do it in the template yourself when needed.

Adrian