There are things that the parser must necessarily decide because nobody higher up the stack will understand them or think to limit them and override the default, even if a configuration object were to be exposed.

For example, one variant of this kind of MIME bomb would be defeated by a limit on the number of RFC 2231 parameter continuations acceptable per header. Even if you were to allow the user to override the default limit as you propose, your library would still need a sane default, because you would probably find that not many people would see RFC 2231 parameter continuations as a threat vector or even think to specify a limit, let alone know what a sane limit would be.

In the end, to be secure, you would have to expose so many limits that just using the library would be a mess.

As soon as you say "that's not for the parser to decide" you run the risk of things falling through the gap and no policy decisions being made at all.

You also have to accept that sometimes the parser designer alone knows best the complexity analysis of the resources the library will need.