You should not trust what you receive, especially content from an external source. If you want to update the display of something, use textNodes, or sanitize the input.
The idea is to remove undesired and potentially harmful elements and attributes ( such as inline style and events that can be used for script injection ) before you append them in the document. To do so, DOM manipulation outruns string manipulation. Any day.
What you receive from an XHR, or any other function, may not be valid XML ( mostly due to badly nested nodes, bad entities, ... ) and thus DOM methods are not available.
When you do
elementFoo.innerHTML = textVersionOfMarkup the browser cleans the crap and generate a usable DOM tree on which you can call any regular DOM methods such as adding/updating/removing nodes/attributes.
FWIW, I prefer to use a white-list of nodes and attributes. This way I'm sure of what I'm up to inject in my document.

the code is not on my USB stick. I'll post it next time I go to the office ( which might be tomorrow

as I have to finish something before our team meeting on monday morning )