At work, we're not allowed to use SP2. My internet world hasn't ended yet.
However, it's generally a good idea to upgrade - SP2 is a significant step forward, and it should be reasonably easy to find out if you're likely to suffer from problems. Most upgrades to SP2 are fine, but you don't hear about those.
If you decide not to upgrade then I think it's fair to say that you do need to take particular care over security. Staying with mainstream websites and being careful with your email is one thing, but the recent internet worms punch directly through Windows security flaws, some of which are fixed in SP2. This is where the firewall comes in. Personally I prefer a hardware firewall to software; ZA should be ok, but there have been worms written that propogate via software hardware problems.