Correct, but I doubt that any facility that is worried about this problem would be unable to afford the $15K.
...and really only detect the surface of the metal under test."
Incorrect. X-rays penetrate quite nicely, in both directions. This isn't photoelectron spectroscopy, which "is" very depth limited. Yes, there "are" shielding effects based on atomic number of substrate, so penetration depth "is" better for lighter elements, but I would certainly expect mm's of penetration if not cm's. I suspect one can get charts from the mfg. with the requisite info.
"They are also a tad tricky to use."
Hardly. Correct interpretation of data requires some knowledge, but "use" is about a simple as it gets....hold it against the "target" and "pull/hold the trigger".
And yes, I've looked at the ubiquitous stories that all contain the statement "it passed a hand-held XRF test". One even claimed that XRF "..only penetrates the first 0.001 inch", which is complete BS. I suspect this was a completely untrained operator that was using it as a "magic box".
TSA agent, perhaps? /sarc>
Cheers!