Many libraries still have unsafe defaults. They come from the XML-age where security concerns were minor (SQL injection was still new to most!)

Using XML in a safe way requires you to study what is wrong with XML first. That is not what many people do.