I've been using Porkbun for years. No complaints.

If you want the cheapest, go with Cloudfare. They guarantee to ask for the wholesale price, which is the price the registrar pays to the top level domain owner, so they can't go lower without footing the bill.

What most of registrars do is foot the difference for the first year, so you get a domain for super cheap, then add 50%+ cut on top, so you pay i.e 5$ for the first year for a TLD that has wholesale cost of 10$, while they loose 5$ on that sale, and then you pay 25$ for the second, so they now gain 15$ on holding your domain hostage.

Cloudfare guarantees that they will sell you that domain for 10$, and only raise it when the TLD owner raises the price.

I'm not aware of any other registrar that guarantees wholesale prices, but LMK if anyone knows any.

If you want to get the best deal, buy your first year (or maybe 10 years, if they let you buy 10 for the sale price) with the scammy registrar, i.e get the 5$ sale on Namecheap, and before it expires transfer it to Cloudfare so you don't pay extra for the second year and can continue with the (much lower now) wholesale price.

Each TLD has a different wholesale price, but every registrar pays the same to them for selling the domain to you. The differences you see is exactly in how much are they willing to foot the bill at first (most have a massive sale on first year, then huge markup on renewals), some just add a flat fee and have markup from the start.

Cloudfare just states "you will pay wholesale", and don't do any sheninegans. At least that's how it was last time I checked.

Cloudflare sells domains at wholesale prices. Protection included.

xyz isn't that cheap (and shady (in reputation and pricing practices)), you might wanna pick a better tld.
I don't see a wholesale price so it's hard to judge with certainty, but xyz might be around 14$/y. Dynadot is selling .com at a loss, so I assume they do the same for xyz. Don't use them, they will make that money off you some other way.

Wholesale for .com and .org is 11$; I recommend njal.la who charge 15$ and for those 4$ add the by far best privacy available for domain registration.

For a cheap reliable tld, maybe .eu is a good pick. From the looks, the wholesale price is 0, so legitimage registrar's costs can get very low. .eu only allows non-profit registrars.

Cloudflare has the cheapest prices and the fastest DNS record changes there is no reason to use anyone else.

I dunno about an xyz domain specifically but njal.la has good privacy protection with domains starting at 15€ annually.

edit: sorry nevermind just noticed you said ten years somehow my brain skipped over that.