This post
brings up a few interesting comments about XML:

XML seems to me overhyped. it is *just* a container for data structuring it
in most cases.

Saying that XML is overhyped is a bit like saying that text files are
overhyped.  The thing is, before XML became a standard, we had a flurry of
text formats used to contain various external information that programs need
(take a look at sendmail.cf or the hundreds of different configuration files
used by any UNIX installation for example).  You never knew what to expect
if you tried to read or edit one.

At least, XML gave us a suite of tools that make editing and reading such
files easier.  It also gave us a wealth of API’s in all languages to avoid
reinventing your own parser, another Good Thing.

In that same comment, Klaus adds:

Besides that it is in fact *not really* human-editable.

… and this I fully agree with.  This is a message I have been pushing for
years but I’ve had a very hard time convincing people.  My
early dislike for XML as an editable format was what prompted me to create EJBGen in the first place, which was one of the very early tools that used
annotations to replace XML (EJBGen started in
early 2001, and its immediate success
showed that I was not the only one having a problem with XML as an editable
format).

It is pretty obvious to me now that as soon as you are creating more than
just a toy program and that your code needs to store data outside the code, XML
is the only sane way to go.

So the question is not really "Why is TestNG using XML?" but "Why is TestNG
using an external file to configure its tests?", as opposed to JUnit where this
is done in code.

The answer is that I make a clear distinction between the static (the
business logic) and the dyamic (what tests are being run) part of your tests. 
I believe JUnit makes the mistake of conflating the two, which forces you to
recompile your code when you decide to run a different set of tests.

If you picture a team of ten programmers, each of them will want to run a
different set of tests as part of their day, and all the time spent recompiling
their test suites is a waste of time.  Not mentioning that they are
modifying code that they need to remember not to submit to the source control
system, since it only runs a subset of all the tests.