My analysis above that 35.5 uA could be reduced significantly was based on the mistaken belief the CFI chip was the MX25L1606E, which has standby current (ISB1) of 25 uA with a deep-power-down current (ISB2) of 5 uA.
In fact the Xenon was updated to the GD25Q32C which claims a standby current (I_CC1) typically 1 uA, max 5 uA, which are the same values as the documented deep power-down current (I_CC2).
In practice, when I put the Xenon flash into deep-power-down mode the idle power current drops from 32.7 uA to 23.1 uA (9.6 uA decrease) when powered directly from 3V3 (XC9258 disconnected), and about the same (35.2 to 26.9 = 8.3 uA decrease) when powered by LiPo (XC9258 connected).
So I suspect the GD25Q32C data sheet lies when claiming I_CC1 and I_CC2 are the same at 1 uA typical, but going to deep power down mode is likely to only reduce current by about 8-9 uA. More reduction might be possible by tuning the GPIO configuration.
Update 2019-02-13: Checking the device JEDEC ID and the contents of the SFDP register, the replacement SPI NOR device is not the GD25Q32C but rather the Macronix MX25L3233F, which documents ISB1 (standby) as typically 10 uA and ISB2 (deep power-down) as typically 3 uA. Much closer to the observed 8-9 uA difference.