You are right of using the diagnostic menu can make some bad things (which are repaired after reboot) but the same can be told about XPosed and installing any of snippets which are not "authenticated".
I disagree with your last long sentence - XPosed is hacking the system/app/whatever you have installed. Custom ROM is not hacking. As "hacking" I mean "modify the application in run-time". I make an example - take the QuickPic - application for displaying pictures and play videos. Creator of this application makes it to display pictures and play videos - no more, no less. Using XPosed you can "modify" this application to browse some web pages. And this is not purpose the developer create this app for. I don't condemns the XPosed fw. It is mighty tool which can help in some circumstances (like tweak OEM ROM), but I primary don't want to use it.
BTW: I use CyanogenMod from version 7 in all of my devices, but you cannot compare XPosed with custom ROM - these two are too way different... and same with rooting system....