It has some ancient history as a morse code distress signal: https://regulatorylibrary.caa.co.uk/923-2012/Content/Regs/03...

And it shows up in some old BSD code: https://www.snellman.net/blog/archive/2017-04-17-xxx-fixme/

But... I think repeated letters are just easier to type than any other string, and since X looks like the classic "marks the spot" logo, it's what people jump to.