With regards 1) We see plenty of PCs with AVG, MSE or what have you, coupled with something like ZoneAlarm firewall. The very fact we see them in our shop riddled with viruses is testament to the fact that nothing is 100% bulletproof.
And 2) The problem with Windows firewall is you might as well not have one installed when it comes to outgoing traffic (pre-Vista anyway, but I do believe even in Vista/Win7 you have to manually configure it to block outgoing traffic). Since a lot of modern malicious code relies on dialling home at some point, it will pass out unchallenged and potentially worsen the infection when it downloads the latest undetectable version of whatever nasty it is.
The vast majority of infections we see come from users relying on freebie antivirus and Windows firewall, so I firmly believe my original points are valid.
That being said even savvy individuals with a multitude of strong security software and properly configured firewalls come back to us infected time and again. The issue is, there is ALWAYS something ahead of the security software, no matter how much they bleat about their "zero day protection" capabilities.