I have and I don't give access to root to my software. Also on my linux computer I can patch the very same moment there is a vulnerability, on my phone I can only patch security fixes when the manufacturer wants and only usually for 1 or 2 years.

Also, have you really audited the code of xposed and xprivacy to see that there isn't any single security flaw that expose your whole phone?