Because that's quite unrelated. Websites display will be fine or break independently of the OS, but depending how the browser has been updated to follow the last trend or not. Same goes for security: if he doesn't install crap on his XP, the main source of danger is Internet: malicious files input to unmaintained programs, and of course his Web browser first. Maybe there are performance improvement coming too, either in the browser or the e-mail client.
Personally, I don't use XP, but I'm stuck with 2.49.1 because they broke GTK2 support between that version and 2.49.5. When I'll have enough, I'll switch to another browser, perhaps Palemoon which still had GTK2 support last time I built it (28.6.1). /Edit:/ Just checked on Palemoon forum: they say they will support GTK2 until at least 2024.
Less cool news: "SeaMonkey 2.49.5 will be the last version supporting Windows XP/Server 2003 and Vista/Server 2008." (https://www.seamonkey-project.org/releases/legacy)
Yep, the "let's drop everything which has been stabilised and working fine for 15 years" frenzy has reached them too :-(