After reading up a bit, version "X" should probably be rejected, whereas "1.[0-9]+" is meant to be allowed also by a 1.0 parser, according to the spec:

https://www.w3.org/TR/REC-xml/#sec-prolog-dtd

"""
When an XML 1.0 processor encounters a document that specifies a 1.x version number other than '1.0', it will process it as a 1.0 document. This means that an XML 1.0 processor will accept 1.x documents provided they do not use any non-1.0 features.
"""

However, this is not so much an issue with the SAX framework but with the underlying parser, which would be expat. Not sure why that doesn't care about the version.

Personally, I don't really care. There are only two XML versions, 1.0 and 1.1, and an XML 1.x parser is supposed to deal with both of them nicely. Anyone who writes something different in their XML version probably does so deliberately and wrongly. As long as the rest is XML, I don't see a reason to reject such an input document.

I'll close this as "won't fix", since there is no practical effect, it would need effort, and it doesn't look like anyone cared in almost 8 years.