If the intention was to spare some XMLInputFactory instances, the XMLInputFactory implementation may need to be thread-safe. I haven't read the spec, however the JavaDoc doesn't guarantee that.
On the other hand, option 2 promotes SPI while API is available, people sometimes do that for performance reasons.
From my understanding, that doesn't seem the case here. SPI has some cons
over API, such as extra dependencies. I think we need really good reasons not to use API. -- Yang ZHONG