Good points.
Lack of Android support for JAXB and performance are two issues which we'll have to investigate before moving from Smack.
That said on the server side at least we've built a number of plugins which use Spring's JAXBMarshaller and performance is excellent so I think it's a change Openfire can make if needs be.
You mention that the parser I quoted above does not consider parsing depth. I spent some time looking at the various providers in the smackx lib, do you have any you could point me towards as best of breed?
thanks!