XUL is no longer exposed to plugins (in non-ESR FF), but is still used internally in some places - where it is slowly being replaced.
XUL was used all over the place, so it takes a while to fully remove it. Thunderbird updates the underlying platform only once per year, catching up with Firefox changes in the yearly major release, while Firefox does so every few weeks.
That's not quite accurate. Thunderbird develops its software with the tip-of-trunk Firefox code at all times. It only makes releases much less frequently than Firefox.
It was XBL (XML Binding Language)[0] that was removed, not XUL - which is being phased out and replaced with HTML where appropriate.