[sacrosanct]

XP has Internet Explorer and I tried this in a VM once, and 99% of sites didn't load because they used TLS 1.2/1.3 which IE doesn't have functionality for. But plaintext HTTP sites loaded fine.

I wouldn't use XP as a daily driver if that's what you intend. There's so many exploits that have piled up over the years that getting pwned is inevitable at some stage and the attack surface of XP is massive.

[theanonymousone]

Is it safe to just connect to the WiFi and download e.g. Firefox, or it's better to get it using a Flash memory while still offline?

[l41n]

I doubt anything would really happen. I connect old computers to the Internet and sometimes have a habit of forgetting to disconnect them for a bit too long. Nothing eventful has happened so far.

If you're paranoid, I'd just use your phone's hotspot.