Indeed, BOAC. Most of these delightful people use the internet extensively to keep in touch with children and grandchildren in far places, so "no internet" isn't a viable option.
So far, the stuff that might have caught them unawares has been stopped by anti-virus and their own caution. They've seen the "hijacked" Hotmail and AOL stuff, and in many cases spoken to the hijackees, so they know Keef is telling them the truth about the risks.
XP lacunae are only one of several sets of traps they have to be protected against: the biggest single effort has been to stop them updating anything from those providers who bundle all sorts of crapware into packages (Adobe being the worst but not only offender). Browser hijackers scare the daylights out of them - these are totally non-computer-literate people.