The file you got sounds neither valid nor well-formed. It might not even be XML.

I know you describe a real-life situation, but if XML gets abused it's not XML's fault - like it's not JSON's fault if JSON gets abused

Could you elaborate why you think so?

As far as I can tell, the file was a fully valid XML file. The issue is that doesn't really tell you (or guarantee) much.

There's just no one specific way to do a thing.