> Unless there's a zero day in Xen

Most of the time, zero days in Xen do not affect Qubes: https://www.qubes-os.org/security/xsa/#statistics