XXE should have never existed.
Whoever decided it should be enabled by default should be put into some sort of cybersecurity jail.