XMPP leaves a lot of metadata and user information around, so it does have a privacy issue that's probably not solvable. Whether it's a security issue is a completely different discussion though.
That's got nothing to do with the security problems OP complained about though. Are there even working solutions to those metadata problems apart from sending dummy decoy messages and purposeful delays on the server side to make correlating message relaying hard?
The metadata leaks are more about correlating pseudonymous identities to the same accounts than network leaks (for which we employ VPN/SSH tunnels or Tor). If you'd like to know more about the threat model of XMPP: https://joinjabber.org/faqs/security/ (critique welcome)
