If the user can change the encoding in the meta tag and thus bypass XSS protection, why is it usually indicated with the tag?

Question

XSS

Hello! I'm reading an article on Habré - "Best practices and recommendations for protecting php applications from XSS attacks".
The third rule from this article reads as follows:

Specify the encoding on each web page.

And it shows an example where the encoding is specified through the header.
And I have a question. If the encoding plays a role in protecting against xss. And if it needs to be specified via header. Why is it listed in the meta tag? On the same hub, in head, the first meta tag is an indication of the encoding:

<meta http-equiv="content-type" content="text/html; charset=utf-8">

Answer 1

It does not have to be specified via header(). It simply must be indicated on every page. Which way is not important