I would disagree with your assertion in the case of PV guests in Xen - they have an extremely small attack surface. The hypervisor may be "on the front line", but is a far simpler beast than the kernel.

Certainly Xen has its fair share of vulnerabilities, but vastly fewer than the kernel.