I've seen some recent examples of XP in the wild, they pop-up occasionally in old ATMs, bus route displays, small stores running a PoS, etc. Not a recommended configuration of course but still happens nevertheless.

For me I enjoy it as a fun/hobby OS. I can install all my favorite tools and games and boot it up whenever. It's also fun to see what modern work can still be done on old OSs. Recent versions of PuTTY work so I can in theory sit on my XP box and drive LLM agents with Winamp playing in the background, chat on MSN with Escargot, etc.

I assume most people who use XP (which by default means non-hobbyists) are using it to run some software that was made to run only on it and the people who made said software never bothered to update the software for another OS. Something like a software application to manage prices in some family-run grocery store or warehouse in a former socialist country or what have you. The people using XP don't know they're even using an old OS, and they're oftentimes not very technical people (to say the least). They're using it because it's their job and they don't care particularly about it. It's usually not connected to the internet

Recently I went to the dentist, and while they weren't using XP, they were using Windows 7 to run some in-house software (I assume) to check my insurance

Yes, im from a former socialist country

The kind of passive infection that is shown in popular videos like this one (https://www.youtube.com/watch?v=6uSVVCmOH5w) tend to only happen if you hook up an XP machine to be directly accessible to the Internet. Like, if you connect your XP machine to your router sitting in the middle of your Internet connection and don't forward every port, you should be fine in that regard at least.

There is also Supermium which is a relatively recent version of Chromium backported to run on Windows XP with all the security patches that brings, but with that being said I still would not do anything security critical on it.