Yeah, its possible that some virus-writer will find some unknown exploit in XP, but with fewer people running XP it makes it a much less valuable target.
This part isn't really accurate for a couple of reasons. Firstly, the issue isn't with people finding unknown exploits in XP. The problem is that later versions of Windows share a lot of the same code as earlier ones (they add and fix things, not rewrite a whole OS from scratch every time). That means when an exploit is found in Windows 7 or 8, there's a good chance the exploit will also work on XP. Microsoft, and any other software developer, generally try to fix vulnerabilities as soon as possible, but XP will no longer get those fixes. This becomes a real issue because it doesn't just rely on malicious people trying to find these vulnerabilities - every patch Microsoft releases for the newer version of Windows is effectively an announcement of how XP can be exploited.
Secondly, XP is still the second most popular OS by a huge margin. Give it a year or two and it might be almost as unpopular as Windows 8 and OSX. XP is going to be a very popular target for some time to come, and it's going to become much more vulnerable than any other target.