Mainstream support ended 15 years ago. Extended security support ended 10 years ago. The last version to have any kind of update at all was their embedded OS version for things like cash registers, with the last security update 5 years ago.

So it's wildly insecure against any new attacks targeting an OS that's largely used by major corporations, governments, and medical facilities that are juicy targets for theft and ransomware attacks.