You are right, and XML parsers can have a very large attack surface due to the sheer amount of specs to adhere to. I see XML as better in the expressiveness it

You are right, and XML parsers can have a very large attack surface due to the sheer amount of specs to adhere to. I see XML as better in the expressiveness it has, and more mature out of the box options to validate and transform it. Security and bugs remain an issue, but at the scale it can be used, there is a fighting chance to have experts dealing with the hardening of it all. Swagger like format definitions are still pretty lax in my option in comparison. Now I wouldn't want to get back to XML land, I just think it occupies a pretty solid niche that is hard to match with anything more simple.