Windows NT, Server 2000 and Windows 2000 are now regarded as end of life by Microsoft. This means that if any new security vulnerabilities are discovered for these operating systems, Microsoft will make no effort to create a security patch.
While I agree that yes, it is unlikely that a virus will be specifically developed to target anything less than Windows XP/Server 2003, since they all evolve from the same code, it's certainly possible that a "modern day" virus designed for Windows XP/Vista/7 can also successfully attack Windows NT/2000. Indeed there was a security vulnerability in September 2009 which affected a whole array of operating systems (including Windows 2000) and they all got a patch except Windows 2000.
Aside from vulnerabilities in the core Operating System, you are also lumbered with Internet Explorer 6 at best. Internet Explorer 6 is known to not implement various protection features that later versions of the browser do, and you're more likely to get attacked by a "surf and get owned" type virus. Then you've got browser plugins (Flash Player, Adobe Reader etc) - these might still release updates for Windows 2000 at the moment, but you're walking on thin ice. Sooner or later, they will do what the rest of the world is doing and stop supporting a 10 year old Operating System. Then you'll have vulnerable browser plugins, and believe me - they are the most documented and exploited, because it's such an easy and effective attack vector.
Third party applications will also become a security problem (if they're not already, they will) as vendors stop patching older versions of the software that work only on legacy Operating Systems.
As an example, Office XP was the last version to run on Windows NT and Office 2003 the last version to run on Windows 2000. These products will become end of life soon (if they're not already) - and Office frequently features in the monthly security updates.
Then you've got all your other software. This won't necessarily cause you security problems, but rather maintainability problems. The majority of software was stopped being tested against Windows 2000 long ago. This means that if one of your applications breaks, the vendor is quite likely to say to you "Well you're running Windows 2000.... what do you expect?".
As an aside, make sure all your Windows XP workstations are on Service Pack 3, as anything lower than that is not supported by Microsoft, and won't receive security updates.