It's certainly arguable that the current behavior is a bug, though I
suspect it shouldn't be considered major since I've not seen any prior
complaints about this.

It should be easy to fix the bug you describe by taking the character
stream and encoding it before feeding it to the XML parser; Expat can
certainly be forced to take a known encoding, ignoring what's in the XML
declaration.

On the other hand, it's not at all clear that changing this is
worthwhile.  This API borrows quite literally from the Java SAX APIs;
perhaps this separation of the character stream from the byte stream
makes sense for some of the Java XML parsers, but I don't know that
there are any Python parsers that benefit from that separation.