Читайте http://qubes-os.org/files/doc/arch-spec-0.3.pdf почему выбрали Xen, а не KVM. Глава
"Xen vs. KVM security architecture comparison", там очень много и подробно расписано. Если кратко - то KVM не полноценный гипервизор слишком завязанный на ядре Linux, по сути VM в KVM является процессом в пользовательском окружении корневой системы.

Вывод:
"We believe that the Xen hypervisor architecture better suits the needs of our project. Xen hypervisor is very small comparing to Linux kernel, which makes it substantially easier to audit for security problems. Xen allows to move most of the “world-facing” code out of Dom0, including the I/O emulator, networking code and many drivers, leaving very slim interface between other VMs and Dom0. Xenʼs support for driver domain is crucial in Qubes OS architecture. KVM relies on the Linux kernel to provide isolation, e.g. for the I/O emulator process, which we believe is not as secure as Xenʼs isolation based on virtualization enforced by thin hypervisor. KVM also doesnʼt support
driver domains."