Does it matter? An attacker has to know about a vulnerability to use it. Unless there's some reason that security researchers would be more focused on vulnerabilities in new systems than attackers are, or something like that.
This is very common, and these vulnerabilities are sold for a lot of money and the buyers make sure to protect their investment as long as possible. Of course that also means they go exclusively for high-value targets which means end users are most likely fine (see Pegasus as an example). But that's not the same as being actually secure.
I'm not ignoring them, I'm just assuming that vulnerabilities discovered by bad actors will follow more or less the same distribution as those found by security researchers.
If we're talking zero-days, then XP offers no more or less protection than any other version of Windows on that front.
Now I have the mental image of some intelligence guy working on a “get into our geopolitical rivals’ grid in case there’s a war and we need to cause a blackout” discovering the author of the post.
Maybe he will meet up with some friends in “assorted fraud” industry at the local after work watering hole and they can nostalgically steal the post author’s bitcoins together. Hacking an XP machine might trigger a midlife crisis though.
Just the other day I found myself capturing a Vista machine into a VM just to preserve some perpetually-licensed software that we can't ever install again because the activation server's gone away
Someone looking to hack the last remaining XP machines would just scroll down the list of new exploits and test them out.
The hacker does, GPZ does not need to know.