If you look in the component reference doc sections, it says

Caution: Props that support HTML strings (*-html) can be vulnerable to Cross Site Scripting (XSS) attacks when passed raw user supplied values. You must properly sanitize the user input first!

Yes, {{ }} Is safe from xss as it will not render as html

Why are you concerning yourself with the usage of v-html in the docs?

Few elements have the ability to use an html prop. Each instance has a heavy note about their usagehttps://bootstrap-vue.org/docs/components/carousel#props . Unless there is a serious security issue with bootstrap-vue, the duty to have a secure app falls on the implementer.