No, ReactOS is not a viable replacement for Windows XP. It may never be, but it certainly isn't now, as of April 2014.
The primary area where ReactOS is lacking is in the very lowest levels of the operating system: the kernel. Device drivers in ReactOS, as well as the kernel's overall architecture, are greatly simplified (simplified = lacking features and support for basic stuff) compared to Windows XP, or even Windows 2000. With as few developers as there are to work on the project, I don't expect this to change any time soon.
Actually, Wine running on GNU/Linux with X11 is a better replacement for Windows XP than ReactOS is! You may question this logic, but stick with me here:
- ReactOS will flat-out crash your system almost on a whim, for doing almost anything. It'll crash more often and more readily than Windows 95 or Windows 3.1.
By comparison, GNU/Linux is an extremely stable operating system on the whole, with well-tested, fully-featured infrastructure to support fast 2D and 3D graphics; robust networking; excellent multi-tasking and multi-processor scheduling; and world-class, advanced filesystem drivers. Comparing Xorg (the display server) on GNU/Linux to ReactOS, Xorg is orders of magnitude more stable, faster, more featureful, and can much better support the Wine API than can ReactOS's display subsystem.
ReactOS has a lot of grueling low-level reverse engineering work to do, before it can start to become a more stable, feature-complete OS. Reverse engineering work takes more time than forward engineering work, and since Linux is open source and Windows XP is not, almost all of the work that goes into it is forward engineering. So ReactOS has many fewer engineers working on it, and the work they have to do is much harder than the work Linux's engineers have to do.
ReactOS has the goal of eventually supporting the kernel driver infrastructure of Windows XP enough that drivers written for the Windows XP kernel can run unmodified on ReactOS. Let's assume they succeed 100% with this goal. Well, most manufacturers are going to stop supporting their drivers for Windows XP very soon, if they haven't already stopped supporting the hardware completely. So, what do you do if there's a security problem with one of the proprietary drivers you're running? In short, the ReactOS folks don't have the manpower to implement a bunch of open source drivers for common hardware on top of the NT kernel infrastructure, so they're hoping to leverage existing drivers -- a tactic that is not good news for the security-minded user.
You see, ReactOS would be fine if it had a modern, well-maintained kernel infrastructure where the drivers were stable, open source, and received continuous updates. But none of those things are true about ReactOS's drivers or kernel.
If you were to pick a project to invest time and/or money into to keep running Windows XP-only programs after XP's death, I'd say put your time/money behind the Wine project running on GNU/Linux, or even on the Mac, depending on your preference. They've done some amazing work in the past, and given the difficulty of their task, they still have a lot of people working on it (e.g. all the engineers at CodeWeavers), and they continue to make great progress with each incremental release.
Don't get me wrong. ReactOS is a great research project. But it will likely never be more than just that: a research project. Especially if you have security in mind. The absolute worst thing imaginable for someone conscious of security is stagnant software that is not receiving incremental bug fixes and updates. As a matter of fact, if you are running XP programs that are no long receiving updates, I'd say that alone undermines your security model, irrespective of what platform you run it on, whether it be XP itself, GNU/Linux/wine, or ReactOS!