I use win98 coz its user interface is better then NT. I used to have NT4.0, but had it replaced back to 98 after a couple months, which i believe worked easier.
As for hardware: i WANT hardware control. In XP (i can't tell for NT4) i cannot access my COM and LPT ports directly, which i need for certain applications. Other then that: i have DOS programs that i still use, which refuse to run under XP, since it does not even have a DOS system.
And for the security issues: maybe the fact that in all my years (i've had a pc since 93) i have never had a virus-scanner installed for longer than a day, and i have contracted 3 viruses/worm in total over those past 13 years (being Tremor, I-love-you, and one i couldn't even find on semantec) and i have manually desinfected my machine all 3 times.
Even worse: the TREMOR virus was the worst one at that date: it had infected over 50% of my DLLs, EXEs and OVLs and all virus scanners that i tried had only one solution: delete all infected files, no recovery possible. I was so frustrated that day, i had taken it upon myself to write a tremor-cleaner that would desinfect all my executables. I managed to write the program within 2 days. Out of all things: I contracted the virus when copying a virusscanner (McAfee, the worst of the lot) which didn't even find it! It was considered a highly advanced virus with polymorphic abilities; it changed size and "shape" each time it copied itself, meaning that off all the virus copies i had there was not a single one in there that looked exactly like any of the other copies. Semantec and the others probably didn't have the stomach to look into the problem and just felt that cutting out the infected flesh was the best way. Even if this meant removing 60% of my windows DLLs > and i couldn't live with that.
All i have for protection is a firewall, which works fine, and a common sense: don't download what i don't know and never install a new ActiveX component when IE prompts for it. (I'M the one in control of my machine, not the other way around).
And besides: it ain't hard to write a virus (i did a long, long time ago) and ur virus scanner won't pick it up, because it only recognizes the ones that are in its list, and im sure MY program is NOT in that list, it'll take weeks or even months before it hits the list, depending on "successrate" and who gets infected.