And that was the downfall..
1: Standardization was made by committee lovers and/or architecture astronauts leaving us with overly convoluted (sometimes to fit lacklustre object models in early OO languages) and complex ways of working.
2: Complexity that introduced security vulnerabilities
Sure, there was some great tooling available, but how much of it was needed because all complexity made it hopeless to work with without the tooling?
I used it for configuration and serialization in some projects, and it was actually great but I almost always diverged from the bloated norms and defaults for readability/writeability (that made it a bit annoying to specify serialization rules).
I mean, why did people prefer?
<object><property name="somename"><int32>123</int32></property></object>
Over just?
<object somename="123"/>
Yeah there is so much "flexibility" in those above designs but it wasn't needed 99% of the time.
JSON was and is so far the best popular compromise between "just plain data" and "some" structure to make automated processing non-painful.
Also as an improvement over XML collections (do you created a container element to specify container target leading to bloat or just map some of the sub-elements to specific collections and hope you don't run into ambiguities?) is that collections are just specific lists to a property.
The biggest drawback of JSON is that we never had a way to handle type specializations/subtyping but had we done that we might have not gotten the universal acceptance across languages.
Yes, comments but whenever you need that you can make a single-line regexp to strip a useful subset of them without affecting anything by the standard by removing matches of
/^\s*\/\/[^\r\n]*/mg