Hm. According to that, C0 control characters *are* legal in XML 1.1, which would mean that to do this strictly correctly we'd have to understand the differences between different XML versions, which we don't --- and, as best I can tell in some quick testing, libxml2 doesn't either. At least, it will happily take random values for the document version.
xmlroot() just wraps the given XML text in a new outer <xml> declaration, without any regard for whether the new version number allows or disallows things that the possibly-implicit version would've allowed before. That seems of a piece with the generally cavalier treatment of the version in the rest of xml.c, though.
TBH, it's unlikely that anyone is going to care about this enough to fix it, even if you could get consensus that making the code more strict was a good idea. (Backwards compatibility would argue against that, so I'm not sure such consensus would be easy to get.) But if you're sufficiently excited about it, you could try submitting a patch and see what happens.
