That’s really not the case, there’s no proprietary parts to inject this into, and pop is one of the most heavily watched distros for a reason.
The minimal things they add to their particular distro are essentially just theming, and it’d be really obvious if they injected something malicious into it.
It would also NOT be too late because they’re a stable distro and have regular releases, it’d have to be a completely last minute unexpected change for that to be the case.
We’re talking about specifically for beginners, it’s not nearly as good for beginners as KDE is. You like xfce because you’re used to it and it works for you, but KDE supports a vastly wider variety of usecases, for example, try having two-screen setup with one screen having a 4k display at 144hz, and the other a 1080p screen at 60hz
This will be impossible to get working properly on xfce. There’s not even a warning, it’ll just act very strangely without explaining itself.
there’s also the same issues with security that cinnamon has. XFCE does work, but there’s no reason to recommend it to someone who doesn’t already use/like it over KDE.