Xray is huge in Russia now. Often the only way to set up a tunnel to the outer Internet.

As to the vulnerability reported - I think it's still better to place Xray behind a reverse proxy and make that manage the TLS stuff.