The answer is that it depends on the situation and what kind of risk mitigation is involved.
Antivirus and encryption DO both impose some performance penalty. Any time you have another bit of software running it'll use some processor cycles.
Now, for the situation at hand, it depends on what they're dealing with as to whether it was a smart choice or not. You don't mention what kind of server they're using, or what you mean by sensitive data. Medical data? Monetary information? Personal records? Company information?
Antivirus is a touchy subject in sysadmin circles. You'll find some who advocate it on everything. Others only use it on Windows. Others say it's a waste. And all of these opinions can be found coming from people with years of experience under his or her belt. Probably because it does, in part, depend on the situation and server use.
Me, I use antivirus when necessary because every @#^$# AV I've run has had issues at some point. Some didn't catch something in time. Others screwed up software on the system they were installed on. Another just decides to stop updating itself, no matter what, unless you completely uninstall and reinstall the AV engine. In the end I think I've dealt with more anti-malware software issues than malware on servers.
As for encryption the overhead on a file server is really negligible in the majority of cases. The drawback is that it's possible if there's a problem, you won't be able to get the data back. Lose the encryption key or screw up an account and you no longer get access to the data.
Unless...of course...you have good backups. And those are encrypted too, yeah? Because if not, your disk encryption is pointless.
Or maybe you got a zero-day worm/infection on the server that your antivirus doesn't yet detect (and you can't layer antiviruses or you'll end up with other problems.) It starts uploading files to a remote network; encryption doesn't mitigate that. Or one of the client systems with legitimate access to the sensitive data starts uploading information in proxy.
The truth is that your provider, again depending on risk mitigation value, would need to evaluate the value of the data and the consequences of the data being misappropriated and use an appropriate security measures to mitigate the risks. Security is a process and it's done in layers. There's no single security measure that eliminates the attack vectors. You can have all the security measures taken and have one disgruntled employee with legitimate access walk out with the information you label as sensitive.
Depending on your data and the amount of risk you are willing to take, you might want to change providers. If you're just talking about a relatively simple file server, the information you relayed is a red herring.