I've just checked the Char production of XML, and it allows the existence of Unicode code point for NUL character (i.e "\u0000").
Actually, the production says:
Char ::= #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]/* any Unicode character, excluding the surrogate blocks, FFFE, and FFFF. */
The comment is inaccurate: #x0 is definitely not included. Note that "\u0000" works in XML content because "\" has no special meaning in XML, so that is just six legal characters. XML 1.1 allows a larger range of characters than XML 1.0, but still definitely excludes #0.