If new exploits or weaknesses in the operating systems are found, and your antivirus / firewall doesn't specifically protect against them, what do you think?
There comes a point where web enabled machines need to be upgraded for security purposes.
But, at the same time, there's no guarantee there will be any significant weaknesses found in XP, just because it's reached the end of it's supported life. Your best security is in how the machines are used when they are online. Most of the trouble people get into on the internet seems to be "do-it-yourself," so I would recommend a healthy dose of good sense, and you'll likely be fine.
... and don't forget to keep regular backups.