The issue is likely with the https, not the XML.  The Flash Player on the chumby devices supports https only for the later versions of firmware, and the Sony dash doesn't support it at all.  And, unfortunately, even those devices that have https support use deprecated protocols.

On the website, the problem is likely cross-origin restrictions.   Unlike the old-school Adobe Flash Player plugin (RIP), the replacement (Ruffle) is restricted to Javascript's security rules, which generally precludes fetching data from another site unless that site explicitly grants permission to the origin site (it can allow everyone, or just specific sites, but the default is "only me" aka "same site policy").

Many chumby-authored widgets work around this by have the chumby content server make the call on its behalf, but this comes at a cost of bandwidth on the part of chumby, since it effectlvely becomes a gateway to the internet for all of the devices.

If you control the server feeding the XML, there are two fixes - for supporting the devices, support http in addition to https, and for supporting the site, add support for access control headers to grant permission to (at least) *.chumby.com.  If you don't control the server, you can set up an additional server of your own to fetch the data from the offending server, and present with appropriate protocols and permissions to the client.