Personally I do install a software firewall and antivirus on HTPCs. The days when your HTPC was mostly "offline" are long past, with Hulu, Apple trailers, BBC iPlayer etc. etc. And whilst all this should be safe .... you never know. And web browsing on the TV is more common/usable now too with 1080p displays.
Also, the days when antivirus would mess up your video playback are long gone, with a decent product and a PC from the last 3-5 years (depending on how cutting edge it was at the time). So there is no real downside other than cost.
But, of course, antivirus is not needed, anywhere, if you practice "safe browsing"!