Name one Mac OS X virus that exists in the wild. You can't, because there are none. There are only a handful of Mac OS X malware threats in the wild, in the form of trojans.
No viruses exist in the wild that can run on Mac OS X, and there never have been any, since it was released 10 years ago. The handful of trojans that exist can be easily avoided with some basic education, common sense and care in what software you install. Also, Mac OS X Snow Leopard and Lion have anti-malware protection built in, further reducing the need for 3rd party antivirus apps.
The distinction between virus, worm, trojan, spyware, adware, keyloggers and all other forms if malware is a pointless one. Whether there are viruses for OS X depends on your definition of the term virus. What can be said without fear of contradiction is that there are known security threats for OS X and depending on the source you look at there are anwhere between around 100 and well over 1000. I fully accept that both these numbers are far smaller than there are for Windows and I am neither defending Windows nor criticising OS X, I am merely observing that both have vulnerabilities and both have security threats targeted at exploiting those vulnerabilities.
What I am saying is that there are known security threats to OS X like there are to any system and there are also unknown threats that have yet to be discovered and vulnerabilities that have yet to be exploited. It also fair to assume that as Macs grow in popularity, so they will increasingly be targeted by the malware writers, recent history suggest this assumption to be correct as the numbers of malware targeted at OS X continues to grow.
Further, it is important to remember that many modern malware writers are no longer bored, dysfunctional teenagers hacking away in their bedroom, but well trained, well-funded, skilled, professional programmers whose intent is to collect your personal data without your knowledge for the purpose of stealing money and goods.
You can and should always observe safe and sensible practice when using any system, you can also harden a system and there are some very good posts on this site by a contributor by the name of munkery that discuss in some detail what some of those practices should be and some good general advice for hardening OS X. The same good advice applies whatever system you are using, whether it be OS X, Windows, Linux or anything else. However, the average person using a computer of any flavour will not want or be able to perform such hardening. They will likely not follow good practice, not because they are stupid or careless, but simply because they do not understand what it entails and because it is often difficult to do. The average punter who visits a link, perhaps from this forum, sees a site that looks just like YouTube and is then told they need to install a codec to view the video will not hear the same alarm bells that some of us will, they will not have checked the link text to ensure that the site supposedly linked is actually the site it purports to be, they will not know what a codec is, let alone that you should never need to install one to play video from YouTube. Good practice means never opening attachments in emails unless you are sure of their provenance, not using IM or Facebook. There are many aspects of such good practice that are just too difficult to observe for the average computer user.
In this context, I would assert that running an internet facing system without any protection, particularly in a SoHo environment where perimeter security is likely to be limited or non-existent, is negligent.
The basic built-in security and protection on OS X (and Windows 7 for that matter) is adequate if you use the local firewall, keep it behind a simple perimeter firewall, keep it patched and updated, don't run any services that open ports, don't use email or IM on it and don't use it to access the web via a browser; but in reality, how many people do that, particularly if you are using only a single home system?
Modern endpoint protection products (not specifically anti-virus, but full-blown endpoint protection) are inexpensive, unobtrusive and reliable. They provide an additional layer of protection and security from which I would suggest that everyone would benefit. They are no-longer the resource hogs that they were a few years back and can protect against known and many (though I accept not all) unknown threats.
If everyone who uses a computer bought and enabled an endpoint protection product today, I believe we would see the malware industry decline rapidly, because it would no longer be profitable for people to create malware. As long as there is an attack surface caused by a mix of human error and lack of knowledge, social engineering and lack of protection, and a profit motive, then we will continue to the see a growth in numbers and sophistication of exploits across all platforms, including OS X.
Finally, I would point out that just about every large organisation in the world spends significant sums of money and effort on securing their systems, whether they are running Windows, OS X or anything else. These are not stupid people who have been suckered into throwing away millions buying unnecessary products and services by deceitful and underhanded malware protection companies like Symantec, McAfee and Sophos. They are large businesses who take a responsible attitude towards their data and their reputation, they employ skilled people with much knowledge and experience and based on an assessment of cost vs. risk, they decide to implement these types of security technology.
I don't work for any of the security vendors, nor do I have any other financial or other interest in promoting their products. I merely take the risks to my data seriously and choose to spend a very small amount of money each year to provide another level of protection and peace of mind and I do this on both my Mac systems and my Windows ones.
This is not an OS X vs. Windows religious war, it is a people vs. criminals war, and I've chosen sides.
