XP has background services that automatically connect to the outside for stuff. Most of those remain inside your network, but not all. It only takes a hardcoded expired domain to get instant infection without any user action.

I would never consider connecting a winXP machine to the internet safe.