[gambiting]

Because ATMs are usually not connected to the Internet, so there are minimal attack vectors. Every time you make a transaction the ATM literally rings up the bank, using an old fashioned modem. They could probably have Windows 95 installed on them and they would still work fine.

[jboggan]

Not really anymore. This was the case with many of the much older OS/2 based machines but the days of dedicated lines are drawing to a close. Most ATMs I serviced were either directly plugged into a bank's network via ethernet cable or they had a wireless router hidden in the external enclosure and did transactions over a non-dedicated wireless network. These were all XP-based machines.

Updates are issued but they are typically on CD-ROMs from the software vendor, and unless the tech servicing company is going out on a monthly basis the machines are not patched or current. It was not uncommon to tack on 6 different upgrade disks to a maintenance call because that machine hadn't been patched since last year.