What's stopping a determined individual from creating their own XML file with their own details, encrypting it with their own key, and placing it on the computer via USB drive?
Before you consider what is (not) stopping them, first ask yourself why they would want to do it to begin with. What do they have to gain by getting a succesful login?
Because if you're using user accounts solely so users can e.g. pick their background color, there's little reason to password protect that, and even less reason to go through the effort to gain illicit access to that information.
If, however, you are handling access to highly private information which should not be shown to unauthorized users, then you really shouldn't be handling local storage on a machine where users have full access. For authorization, you should always rely on a server you manage yourself, which the users have no access through other than the means you've opened to them (e.g. an API).
You can encrypt your entire database as well; but it's always possible to reverse engineer a built application and thus figure out the process of decrypting the database.
When referring to gaming, you can't really cheat in a singleplayer game. If you decide to tweak your game experience without ruining anyone else's (since you're the only player), then what's the harm?
Similarly, I find it very weird that you are giving all your application files and database files to a user, but then worry about them handling the files you've put them in charge of? It doesn't make sense to me, what would be in that database that the user didn't put in themselves? Are you sharing files with private information when you deploy your application and then hoping that no one reverse engineers them?