Embedded operating systems often have customized kernels to accommodate the lower-end hardware in most POS and ATM devices. That being said, it’s still a Windows XP kernel which is a well-known vector and capable of exploitation if not patched properly, which I can personally attest they usually aren’t.
That was a thorough monkey hammering they took. If they weren't patching them before, they will be shortly.