If you're using an OS that is a 10 year old walking security nightmare, I have trouble believing that you also are thinking, "I want to use the modern web". It's like being in the midst of being mugged and wondering, "did I have 3 square meals today?" Sure eating well is important, but using an outdated insecure OS really should be top of mind.
And if you bought XP last summer... well that was your call. XP was acceptable in 2002. It's 2011.
Come on, have you even used XP since 2002? It is not a "security nightmare" if used (or set up) by someone with a minimal amount of knowledge about computer security. These days, with Microsoft's free Security Essentials package, virtually everyone has a decent security package, for example.
WinXP doesn't have several of the security features in newer versions of Windows. And even those it does have aren't as good. Such as buffer overflow protection was updated in Win7, but not since XPSP2 for XP.
It's fundamentally less secure top to bottom. Which is why there is exist many vulnerabilities that exist on XP, but not Win7.
XP is that much less secure than Vista or 7, OK so it has a less capable firewall but my XP installs (and most corporate ones) are sat behind better firewall and other filters than 7 provides. XP is set to get security patches in the same timescales (i.e. not as fast as I'd like in some cases) as Windows 7 until its official EOL in Q2 2014. I will upgrade from XP to 7 some time in 2013, or when there is a compelling reason for me to do so other then XP is due to lose security update support.
Sticking with XP does not mean I don't want (or can't have) a modern browser. FF and Chrome both happily support XP, I'll get my modern browsing experience that way if MS is incapable of supporting its own OS. The problem with XP not being supported by IE9 is that corporates (or home users) who have (or think they have) some reason not to use something other than IE (or use something else in conjunction with IE) are stuck with IE8.
Upgrading from XP to something newer is not a five minute task. Corporate environments require a lot of testing before a simple update goes out sometimes, so a whole OS change is not a small job. Even for me as a home user it is significant hassle: you can't do an in-place upgrade so I'd have to completely reinstall the OS, re-install and reconfigure all my apps, restore all my data from backups, and so forth. Why would I volunteer for all that work if there wasn't a compelling reason? My work time is quite costly and my personal time, while having no monetary value associated with it, is valuable to me in a number other significant ways. And that is without mentioning I'd have to pay for that upgrade I don't particularly need (and hey, that money is needed, there is vodka and cake to buy!).
I know there are reasons for upgrading but they are not compelling reasons for me. Better firewall? I've got one thanks. Better browser? I've got two of those. DX10/DX11? I'm not that much of a gamer that the difference matters and if a game turns up that doesn't support DX9 I'll just not buy it until I have other reason to install a newer Windows (by which time it'll be in a bargain bucket instead of costing £30+£100 for the game plus Windows) if I ever buy it at all. Interface improvements? Nice as they may be, I can certainly live without them.
To add my own bad analogy to the collection in this thread: upgrading from XP just to be able to run a better browser then IE8 is like saving 2p per gallon of petrol by taking a 1000 mile round trip to get to the cheapest pump in the country.
And if you bought XP last summer... well that was your call. XP was acceptable in 2002. It's 2011.