Going without AV is extremly risky. You can go without AS, but not AV.
Verizon techs are likely behind several layers of routers and protection galore on their networks so they don't have to worry about it
I suppose it's more convenient for them if you do nothing, because then they don't have to deal with individual firewalls and AVs people install and blame Verizon for bad connections.
Windows firewall is insufficient.
Having tested my connections without any router, I can tell you that Verizon does not block any ports (grc.com tests), nor applications (observation), nor any traffic that I know of. They do block some spam mails.
So unless your uncle has Verizon's new security system, he is vulnerable.