What is the risk if it's all on a closed internal network? You can safely run Windows 98 as long as you're very careful about what goes in and out at your gateway.
Commerical networks tend to be a bit more robust than Joe Schmoe's basement router. It's a giant pain to keep up with each and every update on everything a store uses (not just self checkouts, things like CCTV systems, HVAC monitoring, electronic signage like smart screens, etc.) so usually it's all controlled at the network level.
I install CCTV, I guarantee you more than three quarters of the DVRs and PoE cameras I install never get updated and are "set and forget". I've pulled out 10-15 year old cameras still with original firmware in giant national chain stores when they do refreshes of their infrastructure.