Microsoft stopped releasing security updates for XPe in April 2019 (the end of extended support). Any XPe device connected to a network is vulnerable to:

: Support for 32-bit color and ClearType over remote sessions, alongside support for Windows Server 2008 capabilities. Embedded-Enabling Features

Run the setup from the ISO to install Windows Embedded Studio on a "developer" PC (even a VM running XP or Windows 7).

To deploy XPe to a device: