If you look at the pseudo-code of Argon2 you'll find that it creates the "tag" at the end of the function:
return Hash(C, tagLength)
The tag itself is just a hash. For Argon2, the Hash call uses Blake2b to create a hash function with configurable output size as the call above implies. For larger output it uses the initial Blake2b hash as starting point and then iteratively creates the follow-up blocks by rehashing the material.
Obviously it would be problematic if all the blocks would be output as that would mean that anybody could reconstruct all the bits if they new the first block. Fortunately Argon2 outputs only 32 out of the 64 bytes produced for each block, leaving 256 bits to remain unknown. This also means that you'd require two calls to Blake2b instead of one, halving the maximum performance that you would expect. Clearly this wasn't designed for maximum speed. Note that the digestSize - the length of the output - is also included in the initial call to Blake2b, meaning that you'll have to know the key stream size in advance.
So is it secure? Well, there are distinguishers for reduced round Blake2 but those are not practical, and it is unlikely that a quantum computer will break the algorithm any time soon. Keeping 256 bits out of each block unknown seems fine as well.
So yes, in principle you could use it to encrypt using XOR. Argon2 also has a limit of $2^{32}$ bytes, so going over 4 GiB is not possible. using a fast authenticated (stream) cipher should definitely be preferable.
