I think that's a bit disingenuous, if you don't mind me saying so. Of course XP won't suddenly stop working. But Microsoft won't be patching the OS, so any new security vulnerabilities won't be fixed. If any powerful new exploits are deployed onto the wild, using XP on an Internet-connected machine *might* be dangerous.
You can call it disingenuous but the fact is in the real world End User problems are not caused by the fact that their PC wasn't up to date, but rather because they downloaded supercraptoolbaradwarejunk.exe. As we all know by now, Microsoft supplying 3 billion patches every Tuesday hasn't put a stop to, or even reduced the effect that even mild malware has on Windows, which manages to sail in like any of Windows' security features aren't even there, purely because users can't resist to clicking "yes".
I remember when Vista came out, there was all this hullabaloo about how you'd not need antivirus anymore and that all the 3rd party antivirus companies were going to die a death. Vista was apparently so secure with its UAC and associated virtualisation of registry writes and system file edits, which were all redirected to a virtual directory under your own folder. Well crap, that didn't stop malware.
Then came Windows 7, and it was apparently the real deal this time. Seriously guys, no more need for antivirus and malware is a thing of the past, it even has Windows defender. Did that stop it? No it didn't, malware still as present as ever. Windows 8 is somewhat better at stopping malware, but it won't be long till that too is like a sieve and lets it all in.
By far a more effective way to secure a machine than to rely on Microsoft to release bloated patches, is to do things like shutting off unneeded services, killing the DCOM ports TCP 135-139, making sure your firewall is STEALTHED and drops (I said drops, not blocks) any unsolicited ping request, passwords on all user accounts including guest, etc etc etc... Principle of least privilege, it's the very basic foundation of having a secure setup.
You sit patching a machine all day and no matter how you put it, you're ALWAYS behind. You close off routes in the first place that are unneeded and are known avenues of attack, and vet ANYTHING else that does get in, and you have a much better chance of getting away clean. I've been antivirus free for years upon years, but I'll bet my configuration is still more secure than the average Joe. Malware can't get in if there's no door... it's that simple.
