My analysis above that 35.5 uA could be reduced significantly was based on the mistaken belief the CFI chip was the MX25L1606E, which has standby current (ISB1) of 25 uA with a deep-power-down current (ISB2) of 5 uA.
In fact the Xenon was updated to the GD25Q32C which claims a standby current (I_CC1) typically 1 uA, max 5 uA, which are the same values as the documented deep power-down current (I_CC2).
In practice, when I put the Xenon flash into deep-power-down mode the idle power current drops from 32.7 uA to 23.1 uA (9.6 uA decrease) when powered directly from 3V3 (XC9258 disconnected), and about the same (35.2 to 26.9 = 8.3 uA decrease) when powered by LiPo (XC9258 connected).
So I suspect the GD25Q32C data sheet lies when claiming I_CC1 and I_CC2 are the same at 1 uA typical, but going to deep power down mode is likely to only reduce current by about 8-9 uA. More reduction might be possible by tuning the GPIO configuration.