Using xpub key derivation for user account balance?
xpub is short for Extended Public Keys. Public keys, as their name suggests, are meant to be public. If the xpub is stolen, then all that will happen is that the thief will know how much money you have and public keys associated with those coins. All you lose is your privacy, no money is at risk.