WinXP has had a long time on the shelf, it’s EOL so it’s not getting updated, and it’s still occasionally in use by businesses - when true, usually on critical infrastructure pieces that they can’t afford to take down to swap to a newer machine. People know this and so XP is a malware magnet. There are about a gorillion scripts loose in the wild that just find IP addresses at random - or not random - and hammer them with a bouquet of exploits, almost all of which will be easily fended off by a modern updated system, but several of which XP is probably vulnerable to.
So, the second you have a functioning network driver and complete your handshake with the internet, chances are good that somebody will be trying to sneak a script up your ass to corrupt the system. I’ve never seen it happen during install but if you’re exceptionally unlucky I could see how it could be possible.