What does this have to do with viruses? Anti-virus software will continue to get updates. Even Microsoft Security Essentials on XP is going to get updates for at least another year.
If there is a hole that someone can exploit in your system. That hole will always be there to be exploited. No antivirus in the world is going to plug that hole. They are just going to be able to remove a tiny portion of what comes through that hole. I say tiny portion because once someone is on machine and if they are even a tiny bit competent, they will quickly know what AV you are running and crypt their trojans so your AV wont pick up the infection.
To put it into an analogy. There is a hole in your dam wall (the operating system) and instead of patching the hole to stop water (the viruses) coming through, you are using a bucket (the AV) to remove some of the water that is coming through. No matter how many times you use that bucket, unless you sort out the hole, the water will keep coming through.
Surely only if they are using IE?
It was just an example of one exploit. There will be many more to come and there are existing ones out there already. Ive seen exploits for java, chrome, flash, IE, firefox, word, adobe pdf, etc etc. If they OS is not supported, dont expect timely security patches.
There are exploits coming out all the time.
I would also like to take time in this post to warn people about the dangers of just replying on antivirus software. If you go to any hacker forum you can purchase crypting services for as little as $5. So for $5, I can get any trojan/virus and crypt it. This means for two weeks no antivirus will pick up the virus. If the person spreading the infection is cheap or a noob they will crypt and spread the same crypted stub many times. These get picked up quickly and antivirus vendors release updated definitions that can stop those viruses in a week or two.
If you are against someone focused on your systems and whom have a little savvy, they can crypt the stub (thats what they call the virus/trojan they are crypting) for much longer. Since there are not many copies of that crypted stub out there chances of an AV vendor picking it up are minimal.
Lastly, only 3% of viruses are traditional "**** up your computer" viruses. The majority of the viruses today are written for commercial gain by organized cartels. They are either spam or ddos bots or they steal your personal data.
Having an unpatched Microsoft system that relies on just an antivirus for security is terrible. I would not hire an IT person who thinks like that.