Is this defense even viable if the Windows XP source code has been leaked and openly shared online, and you can find many copies of it on GitHub?

There's definitely irony in that Microsoft's GitHub is hosting the leaked source code (which probably got sucked into Copilot and every other AI under the sun as a result).

However, I don't think copyright lawyers will care. "They're also committing a crime" doesn't mean you're free to do what you want. That applies especially in ReactOS vs MS, because if ReactOS succeeds, it will compete directly with Microsoft.