PC Gamer has a good article on how long an unprotected Windows XP machine can last on the internet before becoming hopelessly compromised and infected with malware. According to their findings the machine will become infected in less than 10 minutes simply by being connected to the internet, no action from the user required!
If you are forced to run an outdated version of Windows in your environment that is no longer being patched/supported please make sure you are taking appropriate precautions. A system that is inherently vulnerable should never be connecting directly to the internet, (if it is allowed to connect to the internet at all), and should have up-to-date Anti-Virus, firewall, and EDR systems in place. Access to a system like this should also be restricted to ensure it can be isolated should it become compromised.