Let me answer your question with regards to my home country, Jordan.
- All ATMs I have run across run XP. I could see them booting up in the early morning.
(I have no concrete figures though. Banks and businesses hate to cite these, citing reasons like "confidential" and "none of your business, kid!" ).
- What are we doing about it? If it ain't broke, don't fix it. And if they cared to fix it, they have the administrative hierarchy (boss's boss's boss's boss has to approve, and maybe Central Bank too?)
- But ATM physical security is strong. I once got suspiciously eyed by security guards for curiously eyeing an ATM in maintenance mode (or whatever they call it).
At least, the Microsoft licensee over here ensures that businesses and banks (even major schools too) don't pirate Windows, so we have paid for the licenses.
But it's not the same everywhere in the country. For example, my university are already on Windows 10 Enterprise and Enterprise LTSB, and in the worst, Windows 7. Same story for governmental offices, recently getting 7.