ABI compatibility only breaks if the compiler switch is set. Without it, cdecl is implicit and adding it explicitly makes no difference.
It has been a while, but if I remember correctly, expat does not compile when the compiler switch is set. I do not feel strongly about how it should be solved, but expat should at least compile with the stdcall switch. The users who do not replace the default allocation functions are the least sophisticated ones. We shouldn't make their life harder. A default wrapper is fine, too, if you like that better.
explicit __cdecl for Microsoft Compilers