Actually, support for XP for POS terminals was terminated on 2019-04-09, that is, less than 2 months ago.
One may argue that a POS connected to the Internet would be a no-no, but the hack that enabled faking normal XP installs as POS devices to keep getting updates has been well known for years, and just a registry key away, so the number of connected XP/"POS" devices might well be much higher than expected.