It is risky and react did not build the specific subset of DOM, and probably that's why it is named as dangerouslySetInnerHTML
Though it is really needed as CMSes and Comment systems will give HTML string as output and building DOM nodes and then attaching them is very intensive task.
Though this package suggested by Naveen can help reduce the security risks with setting the HTML with dangerouslySetInnerHTML
I hope the explanation helped.