How secure is running a DE in the Dom0 though?
Are they running it there?
Dom0 is sort of a system domain separate from the default domains and any other domains you create. The desktop manager runs in this domain. Your login credentials reside there. Much like a super domain, Dom0 is more trusted than any other domain.
It provides just two functions: It runs the window manager and the desktop manager.