1) People looking to play retro games
2) People looking to work with legacy hardware, especially in manufacturing and healthcare
3) People who want the comfort/familiarity of an older operating system
I'm always careful to issue a disclaimer that Windows XP should never be used for anything where you need security, in practice, I don't see much of an issue. The reality is that although XP is a tempting target in terms of vulnerability, it's not widely used enough to be useful to modern malware.
The machines I sell come with Windows XP Delta Edition[1], which as far as I know comes with all the available updates for XP already installed - no Legacy Update necessary. I've been using the Mypal browser [2], but will definitely try Supermium!
[1] https://xpdelta.weebly.com/xp.html [2] https://github.com/Feodor2/Mypal68/releases
That said, as there's currently no way to legally buy Windows XP from Microsoft (or any official source), it's not really harming anyone to just install it wherever, in my view.
I also sell Windows 10 machines, and they all come with genuine licenses (often also OEM, or I buy them). I often get questions about whether my Windows 10 systems are genuine Windows, but nobody has ever asked about XP.