1) The vast majority of attacks out there are simple programs that install in the OS. They are not some uber VM root kits or the like. As such, a virus scanner running in the OS is perfectly capable of dealing with them. So no, it doesn't give you 100% defense but I bet it stops 99.99% of the attacks out there and that is worth something.
...Personally, I've never been impressed with her as a security researcher. She seems to be rather paranoid, and living in a theoretical world...
Where are you getting this 99.9% figure? Virus detectors most certainly don't prevent 99.9% of attacks. Have you ever used windows? I will admit, most malware is detectable by antivirus, but the job of a security researcher is to pay attention to ALL malware. It is easy to get a virus through a detector if you write your own code. Even if the malware is detected, certain circumstances can allow it to pass as a valid service, and the user will allow it. Security researchers are paid to pay attention to possible future threats and make recommendations to immunize our current systems BEFORE they are damaged. Even if we could stop the vast majority, it still pays to make provisions for a possible catastrophic failure in the event something does get through. Just look at what happened with conficker.
Money is truthful. If a man speaks of his honor, make him pay cash. -- Lazarus Long