Nobody is targeting XP these days

The bots out there do.

it cannot magically get infected from the internet unless you do something.

That’s too theoretical!

XP itself will “do something” and expose itself.