By default WordPress allows adding HTML tags in comments such as outbound links, various tags, etc.
Comments do contain rel=nofollow on links automatically, but if you want to completely disable the ability to add any HTML in comments, add the following line to your functions.php file:
add_filter( 'pre_comment_content', 'esc_html' );