But "OMG it stole XProtect's encryption to be undetectable" 🤦🏻‍♂️

Yes, it uses the same (rather unique) XOR algorithm as XProtect, but this doesn’t make it more "undetectable" than other malware using XOR.

(Though a signature solely on the XOR might trigger FPs matching XProtect)