I think because they're aware Microsoft released a patch for Windows after XP, they're thinking as though XP can be the only one affected by the ransomware. As we've learned, that logic doesn't work since people turn off updates.