This is true. But the code base of Xen is significantly smaller than that of a full operating system running bare metal, so the likeliness of a zero-day comprising Qubes is less likely (but possible).