I had a rear shock absorber burst through into the boot still attached to its mounting. That was in a 2000 saloon, deemed beyond economic repairand promptly scrapped.
Things like this put me off LPG’ing my 3.2.
Any car it your price range is going to be approaching 10yrs old, and you're at the mercy of how well previous owners have looked after not just the paintwork, but also underneath.
As you've found out, just splashing a bit of water over the visible bodywork once a month doesn't really protect the car.
You need to inspect the car, then make decisions based on that. At least you know either way. But remember a 10yr old XF bought on finanace doesn't guarantee serious corrosion free for the length of the loan
An XF on finance would see me looking at 2013 ish examples
Really need to wait for Sky/Fox/Disney to resolve, before I make a decision.