I'm not sure about the malware potential of XML format files.
Everything has to be considered on a cost vs benefit basis. DOT, and their generated DOC files are open to containing macros. Macros are a known malware vector. Actually, my very first exposure to malware "in the wild" was macro malware. Our LAN administrator
was going crazy because we kept getting Office DOC file malware infections, EVERY DAY. He would run network scans to clean the infections, and next day they would be back. Eventually he tracked problem down to documents that were being shared (with a nation
wide company with a commonly known name). They had an infestation, and every document that came back from them was infected.
The point is, there STILL are risks to using that file type. There are mitigations that help control the risk. If you have them in place, the risk is reduced, not eliminated. So your company has to decide if the risk is worth the "cost saving" of not updating
the file types.
What sort of mitigation? Things like:
- using "File Block" to open DOC files in Protected mode to block macros
- daily antimalware scans
Here are a couple of MS articles on the subject.
https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/prevent-malware-infection
https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/phishing
https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/macro-malware