I mean I don't know much about ATM operations but why would you ever base an ATM on Windows? I mean Windows has it's strengths but surely it's quite possibly the most inappropriate operating system to run an ATM.
So, I suspect that the system designer had a choice of "Windows, and bank the money in 12-18 months" or "Anything else, and spend 12 months and a lot of money possibly getting certified and spend 12-18 months developing".
We call that decision a no-brainer, my friend.
You can never be sure you're secure, no matter what a company that you pay a lot of money tells you. Even moreso, considering that in case your certified system blows up, you will probably not get any money in damages, because the certifying company could well go heads up if the attack is wide-spread enough.