Password-based encrypted key storage?
Yes. $\:$ "simply XORing" is obviously malleable, which may allow related-key attacks.

"When storing a short key, e.g. a 256-bit ECC private key," the "good reason to use AES" is

that "the XOR with a single PBKDF2 (or other KDF) output block" is not necessarily sufficient,

since an adversary might also have changed the stored public key.