For those that have said "just throw up a firewall, XP will be fine" I want to play a little devil's advocate.
The attack that rooted RSA's servers was an email attack, It was a PDF with corrupted embedded fonts that exploited kernel bug to make a root hole in the kernel.
Education? This was RSA, and they got suckered in. The idea is pretty complex stuff, imagine explaining what a kernel and root kit are to your parents. Was it a PDF exploit? Technically no, PDF (and email) were just the vectors. A firewall would not have helped (or did not, I assume RSA of all people had a firewall).
IE - just because you don't browse with IE doesn't mean you don't use it. Think of "IE" as a container with some menus, the actual HTML rendering is an ActiveX control that is used in a lot of other programs. Saying 'use Chrome' doesn't fix everything. IE must be kept up to date no matter what people click on for their webmail.
Computer security is hard. A computer is (effectively) an infinite state machine. Some of these states are unexpected, either due to bad design or bugs, and are exploitable. Windows XP is a target for a bunch of reasons, some due to bad design, some due to popularity (a large target for infection), some due to naivete (since Windows is a default install, you don't need to be technical to get it running, so non-technical people are connected to the net), some due to bugs.
I've been online long enough to remember when simple viruses were released to just show that you could - Concept-1. Now, you can make a lot of money with botnets. Thousands, even hundreds of thousands for a good botnet. There are people who can make millions of dollars if they can on your computer (and others). It's worth their time and effort to find all the weird corner cases that even Microsoft didn't think about. It's worth their time and money to try over and over with many exploits to get your box
I'd personally think of the Ubuntu option a bit more. The fact that they're scared of it may be a good thing, they're less likely to make changes that interfere with security. No computer is 100% secure, but Linux is a bit more so. That Popup that says 'make your Windows box faster' and loads an ActiveX control (all safely passing through the firewall) is not a problem on Linux. Downloads need the execute flag turned on to run.