It's used for things like pop-up menus, (i.e. things that can't be done with HTML) and was recently used in some obscure parts of the UI e.g. certificate viewer (however I'm not even sure that's still XUL any more)

I think it's safer to say: It's almost all HTML these days. XUL is very much deprecated.

As we killed XBL, our XUL components because web components. https://briangrinstead.com/blog/firefox-webcomponents/