Keep in mind, if you can't attack the OS directly, you attack a component frequently installed. Apple doesn't run Oracle's latest Java for a reason.
That's why part of safe computing is to disable Java in your browser until you visit a trusted site that requires it. With current versions of OS X, this is done automatically. The fact remains, there is no malware threat in the wiild that can affect OS X, that cannot be successfully avoided by practicing safe computing, without the need for any third-party antivirus app.
Interesting that the DOD *requires antivirus to be installed on all the systems you listed. They added a requirement for Anti-Virus software to be installed and rated it as a Category I (highest) requirement. Within the DoD, you must follow this checklist in order to get "Authority to Connect" to the network.
Maybe you don't know something they do?
The DOD is not running OS X, but rather Windows, so having antivirus installed would make sense for them.
So, GGJ, with the source release all the world's a lab.
The best virus is the one GGJ says has never existed boys and girls. Deep in the fail that stance is. The best virus is the one not YET detected.
I can just imagine the Iranians as their centrifuges spun to oblivion: " GGJ says there's no viruses in the wild for these Siemens PLC's"
Until a virus has been released in the wild, where it can be encountered by an average Mac user, it poses no threat. If a virus were to be introduced into the wild in the future, it would not affect all Mac users, but rather a very small number, before it is detected, reported, and the Mac community made aware of its presence. In most cases like this, a defense to a new threat is in the hands of most users before they ever encounter the threat. In the case of a "zero day" threat, having an antivirus app installed will not provide any additional protection that isn't already available by practicing safe computing.
