Unless there's a zero day in Xen in which case the entire security model falls apart. With all these cloud providers using Xen, I have no doubt that there's already one out there.

This is true. But the code base of Xen is significantly smaller than that of a full operating system running bare metal, so the likeliness of a zero-day comprising Qubes is less likely (but possible).

If there is a zero day in Xen, your attackers are probably also going to be having a very, very bad day.

> Unless there's a zero day in Xen

Most of the time, zero days in Xen do not affect Qubes: https://www.qubes-os.org/security/xsa/#statistics