File-level AV is needed on Servers, it's just the attack vector that's different. If that server allows users to upload any kind of data at all to it (such as all web servers doing anything except serving static pages) it needs AV software. That malware may not be infecting the server but it can infect other clients. An AV alarm on a server can be a very good indication that something bad happened that needs expert review.
Firewalls don't protect against a badly designed application that can get past the firewall.
For example, lets take a hypothetical cross-site scripting vulnerability. There is a script, http://example.com/calendar/addAttachment.asp that drops attachments in a certain directory so they can be appended to calendar events. Since the only way to drop files is to be a logged in user, the writer of the asp page decided to rely on file-level rights to permit people to upload data. Very secure, they thought. The firewall passes TCP/443 and TCP/80 because that's needed for this application.
Nefarious Person (the NP) learns that the exact ASP-page can be called from a guest context. And after a lot of poking around, has found out how to:
- Drop files in arbitrary locations
- Where anonymous-user can drop files where they'll then be served
The NP then proceeds to upload some evil software to those locations and through Other Means direct traffic at those links (SEO hijacking, Evil Popups, other drive-by-downloaders) where http://example.com/ becomes a source of malware.
If that server had AV, it would have raised a big red flag the moment the NP tried to upload the evil software. You'd be alerted to this vulnerable application, and your site wouldn't end up on various blacklists of 'untrustworthy sites'.
There is more to Windows security than worm-resistance.