@ricardowec I completely second @olivierlambert here. Although there is potential for security issues with an OS that loses support, a hypervisor should be treated with extreme caution anyway. I personally never expose a hypervisor in any capacity directly to the internet (for inbound traffic anyway 🙂 ). This practice alongside using very specific and often highly customised software packages should keep everything running smooth.
On top of all this, the underlying kernel, storage systems and such are all custom, so there is nothing really to worry about 🙂
I will be completely open when I admin that I am very new to XCP-NG, but the team seem to be really responsive if you have an issue. I have never seen such fast reply's, even from an unnamed big brand competitor who charge us $$$ for support.