Update: Now it appears virus writers have used XCP as a back-door onto systems where it has been installed (had to sto myself saying "infected systems" there). Not many, apparently, but this probably has as at least much to do with fewer people buying CDs as it does the level of security risk.