A clarification has been made in #10788:

Checkstyle disallows the features by default in XMLs without that extra parameter:

* load-external-dtd
* external-general-entities
* external-parameter-entities

I couldn't find the second and third limitations in the documentation, and specifically not in https://checkstyle.sourceforge.io/config_system_properties.html#Enable_External_DTD_load, since it's related to checkstyle.enableExternalDtdLoad. The documentation must be more explicit about this.