The vast majority of security issues with XP (and some with 7) are architectural. E.g.: you can't fix some security vulnerability relating to GDI on XP without essentially replacing it with Vista/7's DWM. Conversely, 7 has a few security weaknesses compared to 8/8.1 due to missing kernel security features that are, essentially, a binary diff between 7 & 8 rather than a small patch.

"Updates" for XP POS Edition and the like are mostly support filler and don't bring it up to the same security level as a modern OS. I.e.: There's still a bunch of logical vulnerabilities present.