Hi! This is Ron from .xyz - I wanted to shed some light on the subject.
XYZ takes abuse very seriously and we do not allow spam, phishing, the distribution of malware, or any other type of illegal activities in our namespaces. We actively intervene when any of the above activities have been confirmed by our Anti-Abuse Team. As a result, the .xyz TLD has a lower badness index score than most legacy TLDs as reported by Spamhaus.org.
If you are encountering spam from .xyz domains, please forward the emails to xyz_abuse@gen.xyz or open a ticket at gen.xyz/abuse to have this investigated by the XYZ Anti-Abuse Team.