The main point of this product is to protect you from attacks on your Web services. How will your XML parser react if someone throws a few megabytes of information into what should be a short element?