Comments section includes originating IP address, datetime, E-Mail address, homepage, etc. These entities are traditionally not exposed to the anonymous Internet via WordPress. Since the XML dump is structured it’s quite easy to harvest this data. Google is happily indexing and caching these dumps as it appears they’re created in the attachment system (URI?attachment_id=d+) with an HREF to the actual dump. Perhaps someone on the WordPress side can comment on this behavior?
Source: https://thehackernews.com/2011/05/hacker-getting-wordpress-database-dump.html