We investigate the achievable secrecy spectral efficiency in a multi-user extra-large multiple-input multiple-output (XL-MIMO) system. In these beyond-5G scenarios, seen as the natural evolution of conventional massive MIMO systems, the distances from the mobile users to the base station become comparable to the antenna array dimensions. We show that the consideration of spherical-wavefront propagation inherent to these set-ups is beneficial for physical-layer security, as it provides immunity against eavesdroppers located in similar angular directions that would otherwise prevent secure communication under classical planar-wavefront propagation. A leakage subspace precoding strategy is also proposed for joint secure precoding and user scheduling, which allows to improve the secrecy spectral efficiency over a 40% compared to conventional zero-forcing methods, under different eavesdropper collusion strategies.