Absentsa :
How difficult can it be for a company the size of MS to keep XP security up to date?
It isn't so much a matter of difficulty as a matter of practical business sense: continuing to actively support a product that has been discontinued for years is a drain on financial and staff resources that generates little to no revenue.
If you were developing software, how many years would you be able and willing to spare the effort maintaining and supporting previous versions of your main products at your own expense? Few companies support their previous versions for more than two years after a new version launch.
XP is three major versions and a decade ago.