I'm aware of plenty of usage of SOAP, but only between companies that have contractual relationships with each other and who could easily sue each other if one of them tried to exploit a security bug.

That greatly mitigates the risk of a security bug being exploited, especially something like a DOS attack that is easily noticed.

I'm not saying XML is unused.

I'm saying that the specific space where it's use can cause security problems from things like a DDOS are rare.

A legacy backend system that consumes XML docs isn't at risk of a malicious attacker injecting DDOS docs.

When XML is used for data interchange, it's typically only in circumstances where trusted parties are swapping XML docs. Where it's not typically being used is the open Internet. You aren't going to find many new rest endpoints emitting or consuming XML.

And the reason it's being used is primarily legacy. The format and parser are static. Swapping them out would be disruptive and gives few benefits.

That's what it means for something to increasingly become irrelevant. When new use slows or stops and development is primarily on legacy.