There are different interpretations about what "being liberal" means. For example, some JSON parsers extend the language to accept comments and trailing commas

There are different interpretations about what "being liberal" means. For example, some JSON parsers extend the language to accept comments and trailing commas. That is not a change that creates vulnerability. Other parsers extend the language by accepting duplicated keys and disambiguate them with some random rule. That is is a vulnerability factory. Being flexible by creating a well defined superlanguage is completely different from doing it with an ill-defined one that depends on heuristics and implementation details to be evaluated.