I'm not terribly worried about WinXP going out of support in regards to ATM's. These machines should already be fairly well shut down regarding outside connections. They're not running webservers and BitTorrents. They don't have normal users viewing content from questionable websites, installing virus-infested programs, clicking on links in phishing emails, opening some unknown persons Excel spreadsheet with macros enabled, etc. I might even go so far as to guess that many of them have never seen a security update to their OS even when WinXP was supported.

I don't trust Windows for security on a normal user system. But on a dedicated single-function device like an ATM, it's probably not the end of the world if the OS goes off official support. At least not in the short term. I'm surprised that an engineer would base something like an ATM on an OS intended for end-user local computing. I certainly wouldn't have done that myself. But evidently the ATM engineers did exactly that, based on recent news reports. Or more likely, this news is being reported by idiots, as many news reports are, and the truth is ATM's may be based on some chopped down simplified OS that was originally derived from some components of WinXP. Which is not the same thing as saying "ATM's run WinXP".

Besides, if ATM's really ran a full blown version of WinXP, wouldn't that mean that they'd lock up on users frequently, have to be rebooted often, have their registry routinely cleaned, and have the whole OS reinstalled from scratch every year or two just to keep them running?