Many, many, tools/scanners will fall prey to XML, YAML and zip bombs because of the nature of the decoder. There's not a good reason why you're deliberately running a processor on these exploits unless you thought the file was safe (supply chain attack?), you made a mistake (set timeout=0), or want to make a point.
The conclusion is particularly egregious "This is how we - unexpectedly - saw an XML bomb in action. It was very interesting to explore a real-life popular application and find something like this". A deliberately crafted bomb, opened in a not-yet-popular preview isn't an unexpected or real-life situation. Maybe their analyzer helps, but this isn't convincing.