Unfortunately, there is an excuse. Those are often crazy expensive machines and there is nothing wrong with the data they produce or fetch other than age of the OS. It's easy to say air gap them or take them off the network when the money spent on them, or worse, the iron clad contract clauses demanding other earthly penalties they were surrounded with back in a day won't allow for retirement. I kid you not - there are places out there, where to this day you will find old Elonex or DEC boxes running Windows on Novell, with DOS window open fetching data to lotus symphony spreadsheets off serial port equipped Reuters APMs hooked up to ISDN lines. And some commodity markets would probably collapse the next day if those things were discontinued while the only way to air gap them would be to create daisy chain of students feeding and moving floppy drives with every cycle of the batch script. Vast lists of telecom and satellite equipment both on earth and in heavens with no viable or barely any data encryption possible operated day to day with equipment and systems so old that it's scary. And they have to be, in a massive simplification, accessible over the net. Obviously, in most cases they benefit from slightly better IT than the underpaid glorified janitors that populate NHS basements, but the point still stands - this isn't fault of people forced to operate and rely on those machines and OSes - I blame Microsoft and Microsoft alone. And I hope someone shakes that tree to the roots.
What does any of that have to do with the NHS? These machines can be air gapped, we did that to our kit before replacing (and yes I'm talking NHS here, not fantasy land).