if XP is used on a PC that will not and never has seen 'tinternet then is no issue.

If there is an SP4 then it still not be an issue, why would you want security updates?

I always remember an RF bombarding rig (to test robustness for UK certification) running on Win 3.1 and when they calibrated it we asked the question - "why not Win 95?" and the man said "just wait while I switch it on, pause, did you spot the delay?"
Yes I did but I barely had time to say so. It was a proven system that did one job running on a fast PC (fast is relative to the date & Win 3.1). And he wasn't going to port the s/w on Win 95 - remember it keeled over (guaranteed) in 96 days. Vista, 7 & 8 all have to be constantly updated for (largely) unspecified reasons. Corporate Snooping aside.