You're not thinking about the human element. Parsers are implemented by real people, and they make mistakes.

If a format is human-readable and text based it's both far more likely that a) the spec isn't actually complete (because there's an implicit "sensible" option), and b) people don't read the spec anyway and guess the "sensible" option.

There are countless examples of bugs and security flaws in HTTP that wouldn't have been a problem with e.g. Protobuf.