If you're doing stuff The Right Way, you don't wire them up to the public internet, but instead put a VPN router/gateway between ATM and internet uplink to keep out fucktards messing with the internet uplink.

This way, you could run Win98 SE on the ATMs and need not worry about hackers (if your networks are properly firewalled, at least!).