Those are not viruses or other malware those are vulnerabilities, not to mention most are probably patched.
How about Sophos then, they seem to think they've found quite a few:
http://www.sophos.com/en-us/search-results.aspx?refine=1a1e9ea6979a493dba64e1b2ced03044&search=os+x
383 references on their list (no doubt there are some duplicates among them though, so probably fewer than 383, but a fair few)
Current Symantec EndPoint for Mac lists 22 OS X specific viruses, another 24 MacOS viruses that it considers worth looking out for under OS X and many cross-platform macro viruses (I didn't count them). That doesn't include any generic threats that are covered too. Since June this year it had detected 37 network/browser borne attempts to exploit vulnerabilities on a system used by a non-technical user.
I accept that there is no doubt some element of the product making efforts to make itself seem important and making the user feel safer, however, I also suspect that if these threats were made up and non-existent then the security industry would have exposed them by now, and yet most security companies and independant consultants continue to recommend such products.
Also:
Have none of the vulnerabilities listed by NIST ever been exploited?
Will none of them ever be exploited?
Does everyone patch their system right up to date at all times?
Are patches issued the moment a vulnerability is discovered?
Has there has never been any such thing as a zero-day exploit?
Can I just say that this has gone way off topic now, I wasn't trying to stir up an argument on this subject, I know people get heated about it and I really don't want to cause any conflict. It was just a passing comment that I felt I needed endpoint protection on any system I used for daily internet facing activity, that I would recommend the same to anyone else and that in doing so I would be in the company of most independent security experts and companies. Others feel differently and choose not to have any protection, that's fine, it's there prerogative. People can take or leave whatever advice they wish, they've read both sides of the argument now and they can make up their own minds. People have made their point that the risk to OS X is small and I don't disagree with that, but the risk is not zero.
If I'm wrong then those who follow my advice will end up paying around £30 a year unnecessarily to the likes of McAfee, Symantec, whoever, and in doing so will help to reduce the prevalence of malware on Windows systems by not transmitting it to them.
If I'm right, then they stand less chance of having their credit card details or other personal data stolen (I fully accept that nothing can offer complete protection, it merely reduces the risk).
I choose to take a chance on spending £30 a year unnecessarily is all I'm saying.