There is possibly a problem with user education here.
Running software on your computer that is not set to automatically pull down and install security patches to me seems like a far bigger problem than not running AV software. Windows does warn you if you turn automatic updates off , but afaik there is rarely such a warning about third party software.
In your friends case it would seem that he is not getting updates from adobe, since viewing a PDF file should not cause third party code execution so he must be getting PDFs that are exploiting his PDF reader (presumably adobe fixes these quickly as they arise).
Running software on your computer that is not set to automatically pull down and install security patches to me seems like a far bigger problem than not running AV software. Windows does warn you if you turn automatic updates off , but afaik there is rarely such a warning about third party software.
In your friends case it would seem that he is not getting updates from adobe, since viewing a PDF file should not cause third party code execution so he must be getting PDFs that are exploiting his PDF reader (presumably adobe fixes these quickly as they arise).