Even though the XML Report field appears, nothing is generated if a value is supplied.
There is an argument called pattern, though the help doesn't mention that "XML Report" can be an ant pattern.
Actually, the pattern argument doesn't do anything at all. I've submitted a PR for that, as it was a simple fix.
The UI mapping looks more complicated, and I have no experience in that area.
There is also no mention in the migration guide, that the default is no longer **/dependency-check-report.xml.
The default has been changed back to **/dependency-check-report.xml. This was an oversight.
Fixed in https://github.com/jenkinsci/dependency-check-plugin/commit/cff9fe1d670b0a9f0aefc2f8c5f73cb938c33e4e
Fixed in 5.0.2