I've proposed the following updates to section 5.1 to note the issue with UTF-16:
Add, to the end of paragraph 2 ("XML performs ...")
External parsed entities encoded in UTF-16 are required to begin with a Byte Order Mark ([8] section 4.3.3).
Add, at the end of the last paragraph ("This document requires...")
the sentence
If the UTF-16 encoding is allowed, the XML requirement that
UTF-16 encoded charsets be noted with an initial byte order mark
(BOM) should be noted.
If the UTF-16 encoding is allowed, XML requires that UTF-16 encoded external entities start with a byte order mark (BOM).