Browsers have been relying on libxml2 for ages. Nobody bothered to help libxml2 much, let alone pay for maintenance, but treated it like a security critical component so let their CVE teams loose on unsuspecting volunteers. libxml2 burned out, the project got abandoned, and now Google and everyone else are sweating about what to do with their XML parsing code.

Ripping out the least common and most dangerous parts of XML parsing makes a lot of sense if you want to keep using the unmaintained library without actually having to put in the work to maintain it.

The libxml2 maintainer forked the repo and released it as AGPL, a license which does to Google what garlic does to vampires, unless you pay up.

It is not because of specific known vulnerabilities. It is because it is old legacy unmaintained code which is rarely used and which has a large attack surface.