Actually xmms did just release an update. It's become a lot like utils, not much left to do.

As for zerojay, it doesn't have to be 'new code' to be good (in truth new code usually has as many if not more bugs), second I've been searching and the newest xmms specific security alert was 2005. In 2006 I found alerts related to the codecs (affecting windows too) And in 2007 SuSE had a compiler bug that affected a number of apps.

If you have more, that you have found, I'm sure there are a lot of distro's that want to know. Xmms's biggest 'problem' is it allows you to keep using the system for other things while listening to music. Not like winmobile or iPhone where it's all single threaded.