From what I'm reading, it seems that from inside an SVG script, you can call out to javascript functions of the parent page? That seems kinda surprising, I'm sure there are security policies around it, but it means that there are potential security and performance risks/considerations around hosting and serving SVG files that I didn't realize existed.
However, for a long time browsers were susceptible to denial of service attacks from maliciously crafted XML files, which SVG could exploit. (“Million laughs”). This doesn’t work in current versions but it might be a reason that SVGs are rejected.
It's been a long while since I worked on this, but I was always very hesitant to make changes here, because we knew that our current thing worked for almost all customers, and you never knew what changes would break what.
We dogfooded our own client, and at some point a change I made broke the automated SIDN (which manages .nl TLD) emails. I forgot what exactly it was, but they did some really weird stuff. You can't just shrug and say "oh well, that's just crazy, fix your emails" because people do need those emails and getting these types of organisations to take action is like moving a mountain.