[dredmorbius]

It's not a 10-15 year old version.

As of ~2008, a very competent technical friend and co-worker had fired up a virgin WinXP instance, on the corporate intranet, to access some HR website which was strictly MSIE only.

Within the 15 minutes that instance was live, it had been compromised.

Anecdata, from a mythical extraterrestrial at that. But I'll stand by that and his experience.