It's the users fault either way. You can run Windows 10 all day long clean and happy without a security suite if you don't install and don't connect anything ;-)
FIFY. I would not want a Windows box near an Internet connection without anti-virus and a certainty that at least its firewall is enabled, over the years I've learned not to invest trust in Windows out of the box defaults..