Challenges creating a Windows template (contradictory docs vs QSB-091)

Depends on how you look at that. But at least it uses modern, not outdated drivers. If you have more questions about Qubes security model and possible dom0 attack surface, I think I could explain this as well. Long story short, whatever guest OS does should never affect dom0 integrity.