Because the XML ecosystem is a mess. There have been many security issues caused by people using their XML parsers incorrectly (there are plenty of footguns) and no implementor ever seems to implement e.g. XSD, a standard for document schemas, completely or correctly. And don't get me started on SOAP.