@RickiTarr in about 2014 I did a pen test on a Belgian bank’s ATMs. They were running Windows XP Service Pack 2. I was like “you know there was a third one, right?” SP3 was 2008. Of course, I had a long pile of other findings too. When I came back in 2015, all they had accomplished in a year was upgrading to SP3. Not one other thing.
I generally don’t use that bank’s ATMs if I’m in Belgium.