I re-did the output escaping as I was originally double escaping some output.

One issue we may have is with late escaping. You escape quite a bit of output early, and so it looks like the output isn't escaped on echo. This doesn't present a security problem in itself, but VIP dislikes it as it's easy to miss something in the future. Their explanation is here: https://vip.wordpress.com/2014/06/20/the-importance-of-escaping-all-the-things/

I'm not sure if this will end up being a blocker, but it's something to consider.

For now, I've left escaping where it is, and added it in places I did not see it escaped prior.

I did a manual QA: adding all the components pre- and post-escaping and the diff passed. But I'm not as familiar with this as you are, so it's worth another check.