> what are the good reasons for dropping legacy code?

Reducing attack surface.

That is a good reason. Is XSLT known for security problems the same way that CGI was?