That doesn’t sound right to me at all. Yes, many security holes have been discovered in XP, and patched, Vista is supposedly more secure on paper, but that’s what they said about XP when it came out (and it needed all those patches.
I’d say a fully-updated installation of XP is quite likely more secure than a fully-updated installation of Vista at this moment in time - there are bound to be more undiscovered exploits in Vista than XP, because of the relative amounts of time there have been for people to go looking for them.
I completely agree, XP is not that old and by no means hugely more insecure than Vista, in fact as M says most likely it is more secure having been more thoroughly attacked and therefore patched. I’d say unless you absolutely need some functionality that Vista has and XP doesn’t, forget Vista.