That xxe vulnerability sure was brutal and key to the whole thing. It's quite uncomfortable to be responsible for the security knowing exploits like this exist (of which you aren't aware of)
Even worse than a full time security person or team is the dev who cares a little more than usually and gets manipulated into doing "security" part time while still being part of a normal team. That is just a fast track to burnout: massive responsibilities with almost no power. I've seen it multiple times now and it never seems to end well.
This begs the questions: why is this the default? If you know you need it, you can be required to pass a flag to explicitly allow instead of having to disallow. I'm going to hope modern XML libraries handle this the opposite way and chalk this up to PHP being on the older side.
I'd be curious to know the history too. Did they really not forsee that external entities are a security hole?