why do they say xp firewall is weak?

There are 2 reasons for saying such things.

1. Microsoft itself finds bugs and upgrades it when any such attack is observed.
2. You can easily make such an exception that could lead to a very severe attack.

 

By finding the loop holes in the firewall applications.

 

That depends from version to version but you can find some good articles on firewalls and ethical hacking here http://www.go4expert.com/forumdisplay.php?f=55