XP is antiquated in terms of its technology, in particular its security model. Vista, while not a hit with consumers, was a major step forward in security for Microsoft.There is a certain irony in making an argument based on the security model in recent versions of Windows while we're in the middle of a thread discussing web browsers. Both Chrome and Firefox go out of their way to circumvent that security model, despite providing arguably the most obvious attack vector on many modern computers.
And frankly, the modern Windows security model isn't that great anyway. We can solve a privileged execution problem by nuking the machine and reinstalling from back-ups. It's a hassle, but it's a controllable risk. This is the sort of thing that the UAC measures help to prevent.
But if you don't have back-ups of your personal files, you're toast if they get deleted by malware. And since you probably have write access to those files even if you're logged in as a low-privilege user, and Windows doesn't separate which applications can access what data to that extent, the likes of UAC won't help you here. Sure, everyone should keep back-ups, but we all know that many people don't.
And the really bad stuff these days isn't destructive anyway, it's about data harvesting. If someone gets in and starts uploading sensitive data, or perhaps sending out phishing e-mails to people who trust the compromised machine's owner and think that's where the messages are coming from, UAC isn't much good there either. You need firewall and antivirus tools for this sort of threat, and we had those with XP, and if you're doing it seriously you don't run them on the same computer you're trying to protect anyway.
If you can upgrade from XP, you should.
Sorry, but I don't think you're anywhere near making a case for that yet.