Unless there's a zero day in Xen in which case the entire security model falls apart. With all these cloud providers using Xen, I have no doubt that there's already one out there.
Most of the time, zero days in Xen do not affect Qubes: https://www.qubes-os.org/security/xsa/#statistics