Somebody built WinXP from leaked source code and got taken down.

This needs to be repeated in a research context where it can't be taken down. https://twitter.com/leyrer/status/1312364203932626944

The linked article says that the leaked source code might cause security issues for continuing WinXP users.

The opposite should be true. With the source code you can patch issues. Or discover old backdoors.

And it's an excellent research opportunity.

As for the legal/moral problems I have a hacker perspective:

Once something gets into the public eye it must be free to research. Copyright should not apply to research in this way.

Abandonware such as WinXP should be free to use. It's past its commercial value anyway.