Error message refers to "defusedxml.defuse_stdlib()" but calling that does not silence bandit

When importing one of many XML packages, one is presented with the following message:

Using various methods to parse untrusted XML data is known to be vulnerable to
XML attacks. Replace vulnerable imports with the equivalent defusedxml package,
or make sure defusedxml.defuse_stdlib() is called.

However, it does not seem that calling defusedxml.defuse_stdlib() actually shuts bandit up.

It is also not entirely clear that bandit really should shut up, given the following piece of
defusedxml documentation:

Additionally the package has an untested function to monkey patch all stdlib modules with defusedxml.defuse_stdlib()

Nor is it clear how to generally call defuse_stdlib() in such a way that the monkey patching precedes
the importing of the affected modules, and therefor it's not quite clear how this should be detected.

Perhaps simply remove the suggestion "or make sure ..." from the code & docs?

The issue centers on the XML-import warning and defusedxml.defuse_stdlib(); start by tracing where that warning is emitted and how its documentation text is tested. Determine whether the suggestion can be reliably detected, then update the warning or documentation and add coverage so the final guidance matches supported behavior.