Why can't the polyfill be enabled by default? It would fix the security issues and we wouldn't have to worry about breaking websites.

The JS polyfill also makes supporting modern XSLT feasible.

I tried the JS polyfill on some of the basic XSLT that I wrote, and it only kinda worked. I can't imagine how it would fail on anything with any complexity.