Since you haven't got any replies from crap posters,let me answer you on their behalf (reduced by IQ level to -10 for a minute)
1. Safe as in - "The system is secure and hackers can't get into my account and steal my bitcoins because it has 2FA, cold storage vault, insurance etc"
and
What if your xapo account along with your email id is hacked ? No one can stop them.What if you run a script by mistake and or on purpose which changes your xapo copy paste address to theirs ? Very vulnerable,online wallets aren't safe.
2. Safe as in - "They are trustworthy company that will not 'steal' my bitcoins by freezing my account for arbitrary reasons/shutting down the service, as they hold the private keys for all my bitcoins and I have no way to retrieve my coins if they do"
They still have your private keys? You believe them just because they told you to?Looking at it technically,its not even your wallet,its a 3rd party wallet where you'd be hosting your coins.
IMHO, Xapo probably fits definition 1, they seem to have the external security stuff worked out. However, no one can prove (or disprove) that they fit into definition 2. This doesn't just apply to Xapo, this applies to pretty much any online wallet that doesn't give you full control of the private keys.
Correct.Moreover,you can never prove that.