Technically, the issue is not that SVG allows active content. It is that untrusted XML is being inserted in the DOM by Scratch.

Arbitrary SVG content can be safely embedded as an image, either via the img tag or as a background image.

No, this is not the reason.

HTML also can contain Javascript, CSS and load external content.