It really depends on the engine or tools used internally by the developer. The simplest method of storing data is, in fact, XML, or XML-like syntax. The format for models will probably be something different; for example, Unity uses the FBX format for it's models (and it can also import MAs and MBs, Maya's format). The format for textures would be any standard image format.
It's true that XML would be easily hacked, since it's human readable, and that's why the files will be compressed and possibly encrypted in the installation, both to prevent hand-editing and also to cut down on the space the game requires. The engine will have a way of reading the compressed files.
Going off on a tangent, it's entirely possible that the data will not be compressed. A specific example I can provide is that some early installs of GTA IV had an uncompressed/unencrypted WeaponsInfo file, which I had a lot of fun editing :)
EDIT: Here is a link to the WeaponInfo file from GTA IV. Note that it is XML: