My research so far has found XProtect appears at first glance to be a basic AV engine that scans DMG & apps through Safari, Chrome and Firefox. I'm looking to understand what does it actually do and what does it exactly monitor outside of DMG and apps? I've read it doesn't provide protection from BitTorrent and removable USB thumb drives. What else?
The Xprotect "system" is not really an AV engine as such. It looks for a very limited number of text strings, or "signatures," in specific types of files. For this reason, it is far less useful than a real AV program (up to you if you think one is necessary). In addition, it only checks files downloaded with certain apps: Safari, Mail, Messages, and third-party apps that have activated a setting to use Xprotect to check their files as well. Also, it only sets a flag on files, and depends on user interaction for protection. So an un-savvy user may see the dialog warning that a file is dangerous, but still click the necessary button to open it.
As you say, it doesn't protect against BitTorrent downloads (though specific BitTorrent clients could use the feature), and doesn't protect from files copied from any kind of removable media or files copied over a network.