xor-ing is the method used by the One-Time pad, so to say that it's inherintly insecure is somewhat unfair

I would never say that. The only shortcoming of a properly constructed one-time pad is that it (or a copy of it) may fall into the wrong hands.

Also, you'd probably want to do something to bring the characters back into printable range, which you don't do above

I don't see any need to do that. (Apologies if I'm being dumb :-)

Cheers,
Rob