Lack of comments, (nice) multiline strings and trailing-comma support make JSON a real pain for config in practice. I've started using YAML parsers for all of our (once) JSON config files, just to get those features (while preserving the curly-braces, commas, and other JSON-isms). Yes it allows a misguided dev to abuse YAML (mis-)features, but a combination of coding standards and linters can fix that.

Being a super-set of JSON is YAML's best feature.

I would never consider it for untrusted input though.

Yes. YAML and XML do way more than a config format needs. You need key value pairs and basic structures (variables, arrays and maps) and types.

JSON is lacking in some respects but it's still really close to perfect for its use case.