Sometimes even with paid AV/IS if the user is not careful or well aware enough of what they are surfing, no amount of security software will be able to help you to completely prevent you from getting infected. I'm not saying that you don't have to have protections, to me using security programs that are freely available is more than enough and I don't get myself infected because I know what I'm doing.