See this discussion https://discuss.python.org/t/status-of-defusedxml-and-recommendation-in-docs/34762

It may be valid to recommend the defusedxml third-party package over the standard library xml module but the lxml third-party package is the de facto way to work with XML in Python and any security issues which were previously a concern have been fixed and the defusedxml project even now documents that it is safe.