Good writers of markup will always check with those before they ship it. In the case of user supplied markup, that's still an issue today with HTML.
The reality ten years ago, when a number of prominent XML advocates were using XHTML (and actually using it as such, serving it as such), almost all of their sites had user input means where the input was sanitized well enough for HTML to be secure (and not have any markup injection), but not for XML well-formedness (they got all the markup injection risks in XML, but not all the other WF requirements). If the very people who claim XML is easy can't get it right, can everyone else?
I, too, served my web pages as "real" xhtml 10 years ago and loved it :)