I can't actually remember the last time any anti-malware software (built-in or otherwise) actually detected anything like a traditional virus, but there are plenty of computer users who are rather more trusting of links (including ones that download executables) in emails and the like. I don't doubt if I used a machine with all protection turned off and with the level of caution of a typical non-technical user it'd be hit with malware sooner or later. Most likely a browser plugin capable of reading passwords as I type them etc.