[emn13]

That's true for almost any hosting service - it's usually quite easy to encode other information in whatever wrapper is possible. Virtually all image formats (for instance) allow arbitrary metadata, and usually of arbitrary size. And if meta-data isn't allowed, a lossless format like PNG can easily be reinterpreted as a simple byte-array (e.g. 8bpp greyscale image).

Of course, why would anyone bother? It's that hard to find hosters that will host anything, so why do through the hassle to encruft your data with some somewhat unwieldy wrapper?

The fact that it's XML is in some way a "protection" here since for no particularly good reason some character codes cannot be represented by xml (not even encoded), meaning you'll need ugly workarounds to store arbitrary data.