well, when they stopped support for win98SE, there was a KNOWN vulnerability. No massive attack followed. And shortly after there was a 3rd party work around. Can't remember specifics, but it didn't entail much, nor affect 98 detrimentally. Some windows exclusive 'feature'* turned off. If there IS an Xp vulnerability, it's unknown, as of now.
*Something akin to windows 'activeX' (which I turned off before I ever used that machine on the Internet) Made a lot of money fixing machines infected because it was ON.
I've heard, many times: "An unpatched, un-firewalled Win98 box will be compromised within minutes after simply connecting to the internet. " Hasn't happened. My win98 box has been on the net for days at a time up until the no so distant past. Might that be because the firewall in the router??
But since win98 has such a low % of users, why bother hacking into it, may be another logical reason.
Think the same will hold true for Xp.
If my 98 box gets hacked, I'll just reinstall it. (installation disks + the 3rd party patch file on hand)
Or try an old linux distro again. as it used to be a lab rat, getting many flavors of linux installed, reinstalled win, back to some linux flavor and backand forth many times. May log in here running an old version of
KNOPPIX or
Puppy (check the server logs, I may log in running 98 sooner or later)
Could do the same with your Xp install, or make an
image of the HDD.
And what I tell everyone who stores important documents/ records/ etc. Make and keep a backup.
And if it's really important, make it 'off-site'.