We investigate the achievable secrecy sum-rate in a multi-user XL-MIMO system, on which user distances to the base station become comparable to the antenna array dimensions. We show that the consideration of spherical-wavefront propagation inherent to these set-ups is beneficial for physical-layer security, as it provides immunity against eavesdroppers located in similar angular directions that would otherwise prevent secure communication under classical planar-wavefront propagation. A leakage subspace precoding strategy is also proposed for joint secure precoding and user scheduling, which allows to improve the secrecy sum-rate compared to conventional zero-forcing based strategies, under different eavesdropper collusion strategies.