XSLT is rarely used, a significant attack surface, and the upstream libraries are riddled with vulnerabilities. LLMs make the problem worse by lowering the cost of finding new vulnerabilities.