Terrible - truly dreadful - integration with GSuite. Requires a password for initial account creation, although login with GSuite ID can be enabled thereafter. But then, to access via the Android app, you have to use the password on your phone (lots of luck if you generated a long, highly random password in the expectation of never using it again), and then it DEMANDS that you go back to the web interface and enable two-factor authentication via Google Authenticator before allowing the phone to log in. After that, back on the phone, you have to get the code from Authenticator and flip back to the Xero app; you'd better be quick!
From a security point of view, Xero has made it worse, not better.
As an accounting package, my initial impressions are that it's OK (leaves MYOB for dead, but that's not difficult), but the integration with GSuite is not just poor - it's broken, and actually degrades security while making life difficult for the user.