That would be for bedrock rather than Java. Which honestly, would be the one I'd expect an Xbox account compromise to come form as Java edition doesn't really

That would be for bedrock rather than Java. Which honestly, would be the one I'd expect an Xbox account compromise to come form as Java edition doesn't really touch xbox/MS accounts outside of the initial launcher using them to check your entitlements for game, multiplayer access (parental controls). Bedrock however ties much more directly to Xbox et al. due to needing features like joining friends games directly etc. The only exploit chain I can imagine for Java is compromising the chat report system (which honestly, given the initial implementation they attempted to rush out the door signed *only the message you sent* and *zero context around it*, allowing easy spoofing of context to change the meaning of a message; isn't too far fetched that the backend side of it is similarly scuffed.) and then coercing a ban from the game into a wider account ban.