Right, that's the root of the problem: feature creep. Common with design-by-committee.
As with any feature, there are possible use cases. Perhaps you want to create a form document and use custom entities that you modify later to fill the document out.
But the amount of times that's useful is not likely to be worth the potential harm of things like billion laughs. Easy to separate that functionality, and have your XML parser do an element data replace with your own custom tokens. Eg node.replace("{name}", customerName);
As with any feature, there are possible use cases. Perhaps you want to create a form document and use custom entities that you modify later to fill the document out.
But the amount of times that's useful is not likely to be worth the potential harm of things like billion laughs. Easy to separate that functionality, and have your XML parser do an element data replace with your own custom tokens. Eg node.replace("{name}", customerName);