New in no way means secure. I would find it far more shocking if people used windows 8.1 for ATMs.
PS: Also, Windows XP embedded is still supported till 2016 if not longer so while companies need to have a plan in place for upgrading it's not necessary right now.