Is it really that troublesome to strike a balance between implementing something yourself and using a library when the difference is two weeks versus two years?

If, for example, a file format is really complex, it has most likely one implementation that almost everyone uses. If there is a problem with it, you will hear about it. Use that.

On the other hand, if a file format is really simple or you only need a simple subset of it, rolling your own could avoid you getting 0-dayed when the most popular implementation has a vulnerability.

>you getting 0-dayed when the most popular implementation has a vulnerability

vs getting hit when your vulnerable implementation becomes popular. Not an obvious choice indeed.

> vs getting hit when your vulnerable implementation becomes popular.

Which is not going to happen, because there's no point in publishing something that is tailored to your specific purpose.

This reminds me of one Finnish student publishing some sort of OS kernel in 1991 or so which supported only his PC-compatible machine...

Of course, who could rule out that a crappy little domain-specific parser turns into a trillion dollar industry? One should let that remote possibility guide the decision making at all times.