Minimizing the TCB in dom0?

What is “enough”? How is it defined?

until any appvm with passordless root compromised.

Could you expand?