I have signed up to the coinbase vault service but have yet to use it or read the fine print regarding the insurance.
I dont know about xapo but coinbase says they store all customers vaulted coins on paper wallets and usb cold storage in bank vaults around the world. So virus on customers computer should not be an agument with insurance. Employee security is still a concern but should not stop the payouts.
To deny insurance they must prove negligence on the customers part.
I would be all for a annual or quartly independent audit of all coin that should be accounted for in their vaults at anytime.
if user negligence means you lose insurance, you are better off printing a cold wallet yourself!
I think the whole point of having the 'vault' setup it is takes the process of printing the cold wallet out of the users hands, thus taking away the probability of negligence on the users side and placing it with Coinbase. IMO good for not so tech savy people that are worried about their coins but still believe in companies to control the security of the funds.
Not what bitcoin is really about but a very good way to move it mainstream.