And they can't stick it in some kind of VM while they work out what to do with it?
These stats are measuring where XP is running. It's not going to make any difference whether it's on physical or virtual hardware. Of course if you have to run XP then running inside a VM is probably a good idea but still not a panacea. You might not be able to isolate the applications from the outside world and even if you can it's still possible to suffer a breach if the damage occurs within the VM itself.