I prefer to build purpose-built KVM guests using a very small openRC+Gentoo template as a base. From there you can manage risk pretty effectively IMHO. Xen has had a much worse track record vs KVM. I know the Qubes team goes a long way to harden it but I am just not sure that it is all enough OR even necessary.