Because of recent issues with Nokogiri when parsing untrusted XML, when using old versins of libxml2. So we're full  avoiding to use Nokogiri over untrusted input.