We are and were aware of the rising trend of 51% attacking "minor" coins. Mainly because of that, we designed our custom triple-purpose mining scheme: It combines the best of merged mining and stand-alone mining - merged mining secures the chain while the stand-alone mining part still builds a mining community and distributes coins widely.
So to answer your question: Merged mining makes a 51% attack very hard. Xaya is merge-mined by at least one major Bitcoin mining pool at the moment, which gives it a SHA-256d hash rate of 1.5 EH/s - to put that into perspective, that is 3.75% of Bitcoin's hash rate. In the future, we hope that we can get even more miners on board as well, and rise that even further.
I do not know what hash rate BTG had during the attack, but with the amount of hashing Xaya has, it certainly takes more than some random guy renting GPUs in the cloud.