The XLB setting is on-by-default in the code. The only thing this will affect is the list of "types_to_check" -- the experiment overrides the code still, and the only thing that changes is that types 16 and 17 aren't checked due to the experiment. Those are "CSP_REPORT" and "PLUGIN_RESOURCE" which according to UMA are never used on Android.

I'll keep the .cc code that looks for the finch trial so we can still re-enable checking types that the .cc code disables by default, in case we discover a campaign using (say) only blacklisting CSS or images.

https://cs.chromium.org/chromium/src/components/safe_browsing_db/remote_database_manager.cc?l=111