Newer PC's you can buy have antivirus protection and a firewall built in, however a lot still don't, and many of those that do are only trials.
Most don't know they need one because they've never come across the need, or don't want to spend money on them even if they do. It's just lack of information.
However as for firewalls, Windows firewall is of a decent quality despite what people say. The main flaw is that it doesn't let you get a lot of detailed information on how things are going on it's defence, but at least users of XP SP2 can know that they have free protection against many online threats.
Microsoft are also developing anti-spyware programs now, which in time will be on all PCs in the next few years.
In more time they will most likely make a free antivirus program which users of Windows will be able to use for free. And so on. In the end Virus protection, spyware and firewalls will all be automatically on and automatically configurable on all PCs for all users by about the end of the decade, if all goes how I predict.
So it's luckily a problem that should be avoided with all luck. Unless we run out of electricity, in which case it doesn't matter at all