Unless there's a zero day in Xen in which case the entire security model falls apart. With all these cloud providers using Xen, I have no doubt that there's already one out there.
This is true. But the code base of Xen is significantly smaller than that of a full operating system running bare metal, so the likeliness of a zero-day comprising Qubes is less likely (but possible).
If there is a zero day in Xen, your attackers are probably also going to be having a very, very bad day.