> for the remote servers to resolve and execute blindly

I'm not sure who would would to that but I certainly didn't. Ultimately XML-RPC is no different from REST/JSON except it's in a different format. What you did with that format is a totally different issue.

Just take the first example from wikipedia:

    <?xml version="1.0"?>
    <methodCall>
      <methodName>examples.getStateName</methodName>
      <params>
        <param>
          <value><i4>40</i4></value>
        </param>
      </params>
    </methodCall>

The thing is meant to call arbitrary functions with arbitrary arguments. It doesn't take long until there is a straight up exec functions exposed or some accidental command injection.

It's strange to look at it 20 years later. The adoption of JSON really got developers to stop shipping RCE vulnerabilities every other week. Yet nobody must have thought of that when deciding what to use.

What do you think happens with REST and JSON? Or SOAP? This is exactly identical to:

    {
        "methodName": example.getStateName
        "params": [14]
    }

Although you'd probably instead have an REST endpoint contain the method name and the entire JSON body is the parameters. But the difference is minor. There's no reason this allows arbitrary execution than anything else.

Methods directly exposed to the web is how 99% of all MVC frameworks work.