That's the reality, though.
I'm the "only game in town" when it comes to computer help for a fair number of silver-surfers in the three congregations here. Most of them are using XP because that's what the computer came with, and they have no intention of spending a hefty slice of their pension on upgrading to something different. So XP it remains, and will.
What I have done for them is to make sure that they have decent (free) virus protection, and educated them NEVER to click on links in e-mails from people they don't know, or on strange-sounding links from people they do know.
All have had the usual crop of e-mails from hijacked Hotmail and AOL accounts, and all have let me know that they did what I said and deleted them without clicking on anything. I've only had to to one "disinfection" in the last year or so.
If Hotmail and AOL can screw up to the extent that complete ID and password lists are compromised and the users' address books hijacked for spamming and virusmail, I see continuing to use XP as "undesirable, but not the biggest problem in town."