The xpub key is a master public key. You can see it as a collective list of all addresses in a HD wallet (both already used and unused).
As the xpub key is a public key, it doesn't allow people to spend funds (you would need the master private key / xpriv key for that),
but it does allow people to listen in on all your transactions and balances, xpub keys are eg used in read-only wallets.
Awesome thanks for the explaination appreciate it man👍
Will lock post to prevent spam👍