Because ATMs are usually not connected to the Internet, so there are minimal attack vectors. Every time you make a transaction the ATM literally rings up the bank, using an old fashioned modem. They could probably have Windows 95 installed on them and they would still work fine.
Not really anymore. This was the case with many of the much older OS/2 based machines but the days of dedicated lines are drawing to a close. Most ATMs I serviced were either directly plugged into a bank's network via ethernet cable or they had a wireless router hidden in the external enclosure and did transactions over a non-dedicated wireless network. These were all XP-based machines.
Updates are issued but they are typically on CD-ROMs from the software vendor, and unless the tech servicing company is going out on a monthly basis the machines are not patched or current. It was not uncommon to tack on 6 different upgrade disks to a maintenance call because that machine hadn't been patched since last year.
They use it because it works for them and it's not worth upgrading and taking on that risk. That said, that in no way excuses using XP for new development.