It's not all that bad. First of all I don't think that Windows XP is more vulnerable than any other software product in the consumer market with the same complexity. Quite to the contrary. An up to date installation of Windows XP is probably as good as it gets for most of us.
Don't forget that newer versions of Windows are also vulnerable, most of the time even by the same exploits. The reason for this is the large codebase all of them have in common. Other operating systems like Mac OS X and Linux have their issues, too. They are just not as targeted as Windows is, because they are not quite as widespread.
In the case of ATMs Windows XP is just fine. ATMs are operated very differently than a typical PC is:
- They are set up by corporations that have an interest in keeping them safe
- There are no users surfing on dubious websites or opening mail attachments
- Only software that is needed, is installed. You don't expect a big office suite, a modern browser and other things to be installed on such a system. This vastly minimizes the attack surfaces.
- They are not exposed to a LAN with potentially infected machines. The only way the user can interact with the system is by pressing one of ten or so buttons.
- There is probably a whole lot of network monitoring going on, so any unusual traffic will raise an alert.
- Most vulnerabilities can be mitigated with proper configuration, e.g. by using EMET. I fully expect that these systems are administrated by experts.
Furthermore they are just dumb terminals after all. The ATM itself is not bookkeeping your account, but is only sending the appropriate commands to the bank, where all of the important stuff is happening. In Europe, where chip cards are widely spread, there is additional security as the chip card gets involved into any transaction, so the other side can be quite sure that someone with a valid card is standing in front of the ATM.
Does all of this mean that ATMs are perfectly safe? No, of course not. There have been instances where ATMs were exploited. But as soon as you start to inform yourself about security, you are going to notice that there is no perfect security. Its always a tradeoff and you need to balance correctly.
By the way: Maybe you want to listen to the most recent episode of Security Now, which is a podcast dedicated to (digital) security.