I think the GP is more an statement of how bad security is with XML than how good it is with SQLite. See for example https://owasp.org/www-community/vulnerabilities/XML_External....