It wasn't even just that. In the companies I worked, it seemed like nobody other than me understood how to escape things for XML. I couldn't even convince them to just use the right libraries/functions that auto-escape and parse things properly. They keep deciding they were smart enough to do it by hand. And it always ended up biting them.

JSON, like Javascript (vs C++ or Java) is a lot more forgiving. It either works or it doesn't, and the values are just strings or numbers. And some people even do the numbers as strings.