In 2019, Microsoft released a patch for WinXP because there was a remote code execution vulnerability, and there were enough WinXP machines still around to make this a big deal. A machine without this one patch would still be immediately vulnerable.
Looks like I misread and this requires RDP to be enabled, which is not the default. But it was pretty common, Rob Graham counted almost one million hosts. https://blog.erratasec.com/2019/05/almost-one-million-vulner...