There is IE8 for XP.
I would advise to upgrade not because IE8 is a lot better but because other software may use its libraries (and hence be vulnerable to any of its exploits).
What other software? If you are talking about within the OS or OS related, XP was designed with IE6 and in spite of dire warnings I have never seen it stated that updating IE was essential.
I have a lot of software that has never been updated for a number of reasons, some I only have a license for a specific version, some the later versions have either become bloated or been changed in some way.
One of the most recent was Avira which earlier in the year removed the option to choose when to update the product, if I reach the point where it no longer works or definition updates are no longer available I will move to something else.
I am sure that nobody here would disagree with the statement that there is no such thing as 'complete security'. I have a range of security measures in place that probably go beyond what many people use and the last untoward thing I found on any of my computers was a tracking cookie, that was several years ago.
I am under no illusions that my systems are impregnable but I believe that more important than what version of a program you have is how you use it.
There are a small number of exceptions to that, Java for one, but I would not include IE in that group, in fact the only reason I updated to IE7 was because I preferred it.
I have no doubt that in years to come the same things will be said about IE* that are now being said about IE6 and there will still be large numbers of people who use the older versions without any problems.
I am not against updating things I just think that the issue gets out of hand at times.
New is not necessarily better, or safer. It's a question of balance and what I feel is right for my computers and the way I use them. If one of my systems did get exploited that's down to me, no-one else.