A few considerations I do not agree with:

> YAML is insecure by default. Loading a user-provided (untrusted) YAML string needs careful consideration.

That is trivial. Everything you execute that come from outside is potentially dangerous.

> It’s pretty complex

I would say, that YAML is more expressive and has more features. On the other hand is true that TOML is a valid alternative in many use cases.

> 3.5.3 gets recognized as as string, but 9.3 gets recognized as a number instead of a string

That is correct, in my opinion, 9.3 is a float while 3.5.3 is a version. If you want both to be strings, use quotes.