A #Bitcoin XPUB will yield addresses, but it cannot reveal the keys that unlock those addresses. So giving someone your XPUB is not a security risk.

It is however a privacy risk. Someone who knows your XPUB knows every address that that wallet has ever used and could ever use in the future.

So if you share an XPUB, my recommendation would be to use a specific XPUB that you made just for the purpose of sharing. Use it to receive coin only, then move the coin to your actual, unshared wallet.