Enterprises can buy expensive support contracts direct from MS and still receive security updates. This is fairly common in big companies and with the government. There's articles about them paying for XP custom support from 2014, I'm assuming they still are.

https://www.theguardian.com/technology/2014/apr/07/uk-govern...