Security software is typically only good against known attacks. Given a new method of attack, the security software is not able to defend against it any way so users are still at the same risk to that particular attack as those who don't run it. The only advantage comes when the security software vendor releases an update for the attack before the OS vendor. In the current MS environment, security software is a big business, so there is little incentive to close holes in the OS that allow attacks so long as additional purchased software can do the protection.

Security software vendors have tried to stir up the FUD on Mac OS X, and each time it fails. They'd like to add Mac OS back to their revenue streams, as it was in the OS 9 and earlier days, but OS X is simply much more well designed in regards to security than Classic Mac OS or Windows. That's not saying that it's particularly good, but it's much better.

Also, OS X has a built-in firewall system. Also a true multi-user system, and a privileged access system similar to (but less annoying than) the UAC of Vista. Security is there, whether the user really pays attention to it or not.

ALSO: Many PC users are under a false sense of security due to their use of security software. Many users think that if the software is there, they are safe. They don't worry about running the scans, or updates, or checking the logs. They think it's just an install-and-forget thing that is normal. Needing to spend time and money to protect yourself when your OS vendor won't design the flaws out of their software is stupid. And thus, so is the security paradigm of Windows.