ATM running Windows XP doesn't mean its less secure
Than e.g. OpenBSD? It sure does.
I think, as has previously been said, the difficulty in getting physical access to the business end of the hardware is infinitely harder than actually exploiting the equipment. The operating system is the least of your worries when you are trying to work out how to get to the machine itself, thus rendering the choice of operating system pretty much pointless, when you have things to worry about such as availability of software, cost based on insurance against this sort of thing, etc etc