So although the production permits � , the well-formedness
constraint points back to production [2], Char, which John supplies,
and which disallows all values below 32 except 9, 10, 13, and 32 itself.
Indeed. In XML 1.1, C0 characters other than NUL are prohibited from appearing explicitly, but may appear as character references. The C1 control characters from #x80 to #x9F (with the exception of NL) are allowed in XML 1.0, but prohibited in XML 1.1 except as character references.
Of course, everything about XML 1.1 is of merely antiquarian interest now.