.xyz is just such a radical name in terms of track record, response and usage. On one hand you have companies like Google picking it for Alphabet (although it was likely due to reason of just having a memorable and clever domain abc.xyz), on the other hand companies like Namecheap kicking the domain out of its registry.
The domain is so cheap that it attracts an army of spammers, which causes lots of headache to all kinds of service providers, as well as owners of legitimate website owners running on .xyz domain.
Yet there are also still many domain investors and brokers holding on to premium .xyz names that do not come cheap.
The risks of running with the .xyz domain are obvious - search engines might penalize them in their listings, your registrar might change their position on servicing it, etc. But I am hopeful that the big search engine companies have the tools and smarts to be able to dissect between a scam and a legitimate site, so not to penalize everyone who invested time and money into a quality resource.