MS-Deploy is not ignoring your XPath – it is ignoring the whole parameter because of the characters that the parameter value contains. A value that is supplied inline in a .SetParameters.xml file is allowed to contain only ordinary text.
If the string contains one of the four characters shown below MS-Deploy drops the parameter silently and the default value that was baked into the package stays in the file:

@    <    >    &

(The rule is documented in “How to: Use Deployment Parameters” on learn.microsoft.com: “If the value that you specify for the value attribute contains the ‘@’, ‘<’, ‘>’, or ‘&’ characters, you must store the value in a file and specify the file name preceded by the @ symbol.”)

Your XML token obviously contains “<”, “>” and “&”.
Because of that Web Deploy never applies the parameter and the placeholder ProfitConnectorToken is left untouched.

Fix / Work-around

1. Put the XML that you want to insert into a separate text file, for example ProfitConnectorToken.txt:

   <token><version>1</version><data>XXXXXXXXXXXXXXXXXXXXXXXXX</data></token>
   

2. Refer to that file from the .SetParameters.xml file by prefixing the file name with ‘@’:

   <setParameter name="ProfitConnectorToken"
                 value="@ProfitConnectorToken.txt" />
   

That is all that is required; you do not have to HTML-encode the string in the text file – MS-Deploy will read the file, treat the whole contents as plain text, and (because it is an XmlFile parameter) write it into the <value> element, escaping the angle brackets automatically so that the resulting web.config remains well-formed:

<value>&lt;token&gt;&lt;version&gt;1&lt;/version&gt; ... &lt;/token&gt;</value>

(If you prefer, you can Base-64 encode the data and decode it at run time, but using an external file as shown above is the simplest and the recommended approach.)