https://docs.python.org/3/library/xml.etree.elementtree.html

Warning The xml.etree.ElementTree module is not secure against maliciously constructed data. If you need to parse untrusted or unauthenticated data see XML vulnerabilities.

xml.etree.ElementTree is in use in getexif() and now getxmp(). So the earliest Pillow version affected is 7.2.0

The Python docs later recommend defusedxml.

The defusedxml Package
defusedxml is a pure Python package with modified subclasses of all stdlib XML parsers that prevent any potentially malicious operation. Use of this package is recommended for any server code that parses untrusted XML data.

So this PR replaces xml.etree.ElementTree in getxmp() with defusedxml.ElementTree. If it is not installed, an empty dictionary is returned instead and a warning is raised.

The use in getexif() is simpler, so I have just used re there instead.