Using xmlrpc is potentially unsafe and defusedxml.xmlrpc should be used instead.
We should enhance the existing use-defusedxml codemod to replace calls to xmlrpc with defusedxml.xmlrpc.
See this Semgrep rule for an example of the kinds of patterns we should detect and replace: https://semgrep.dev/r?q=python.lang.security.use-defused-xmlrpc.use-defused-xmlrpc