My router has a pretty descent firewall so i feel like it should be safe? Maybe. Obviously I won’t be signing into any online accounts or anything like that on the XP machine. Is this a bad ideas? Obviously using Windows in general is a bad idea but I’m sort of limited by the hardware here.


XP has background services that automatically connect to the outside for stuff. Most of those remain inside your network, but not all. It only takes a hardcoded expired domain to get instant infection without any user action.
I would never consider connecting a winXP machine to the internet safe.
Other than windows update, what other background services call out?