Running script in a downloaded SVG file does not represent a security vulnerability. Script runs in the sandbox and (unlike it some browsers), locally loaded scripts have no special access to the rest of the system.

You can also download a HTML file containing script and, when opened, the script will run. Can you elaborate on why you believe SVG should be treated in a special way?

I ran the following scenario -
This svg file is on my desktop (Windows OS) which is available at C:\Users\<username>\Desktop and line no 2 is pointing to a valid file on my C drive under C://POC/cert.cert.
Open this svg file in chrome and it downloads the msi file without even changing the URL to the target installer file. 

<svg xmlns="http://www.w3.org/2000/svg">
<script>alert(window.location.href="/../../../POC/cert.cert")</script>
<script>alert(window.location.href="https://dev.mysql.com/get/Downloads/MySQLInstaller/mysql-installer-community-8.0.3.0-rc.msi")</script>
</svg>

is this look similar but utilizing other file types?
https://wwws.nightwatchcybersecurity.com/2018/02/26/multiple-instances-of-download-protection-bypass-in-googles-chrome/

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot