There's an easy enough way to secure the XP VM that the bootleg EPC's run in. Simply disable the network port in the VM settings. There's no reason for the VM to ever connect to the internet or network anyway. So long as you aren't installing viruses on the VM (why would you be installing ANYTHING on the VM?), there's no risk of anything getting hosed by XP's incompetence except the VM itself.

XP's deficiencies come from outside influences via network. Running XP itself is quite safe, provided that you have it disconnected from the outside world.