Same here.

A couple of blue chip websites I‘ve seen that could be completely taken down just by requesting the sitemap (more than once per minute).

PS: That being said it is an implantation issue. But it may speak for itself that 100% of the XSLT projects I‘ve seen had it.