When you start XBAP, you need to decide between full trust and partial trust. Partial trust limits some of the things you are allowed to do (for example, access to local storage, printing, etc.). A full-fledged XBAP can perform the same actions as an application, but there is a huge problem with signing it (it must be signed for users to run it). We (my company) tried to achieve this in order to work last year, but could not do it correctly with self-signed certificates. It turned out to be very difficult, and, in addition, there were no resources available to approach it. Perhaps this has now changed.
It depends on its transformation - you need to exchange several things (for example, the window should be replaced with a page), and the navigation functions are radically different (more like your own web application with history, etc.).
The XBAP application runs in the sandbox on the computer (at least in partial trust), so it loads and runs locally (in the browser). This means that if you do not make some kind of automatic update scheme, it will be used in the old version, the next time the user starts it. If he contacts him from a published place, he will be updated, and the new version will replace the old one.
As for resources - converting is basically a matter of copying an old application to an XBAP application - among other things.
Hope this helps.