It’s not flat out wrong though. Best practices for when your OS is EOL are different to best practices for a currently supported OS.
All those “experiments” where people go online with a new install of xp and are compromised in minutes disable windows firewall and don’t use any antivirus software. You seem like an expert - is that best practice? Do regular people just turn off the Windows firewall and disable their AV?
Believe it or not, firewalls and AV still stop unpatched security vulnerabilities - the security patches just mean they don’t have to.
If you disable the firewall and AV, sure, you can get in trouble. That’s not following even the most basic online safety steps though.