I think the clue is in that it was an "old lady", who doesn't use it for much.
My mother still uses my father's old laptop, which I'm sure hasn't had its AV or firewall renewed or updated since he died almost four years ago.
It's still remarkably free of nasties, because she doesn't websurf, and has only just barely mastered e-mail. She's frightened of touching anything she doesn't know, in case she breaks something, and in this respect at least, her paranoia has stood her in good stead, because she's unlikely to open, let alone act on, unsolicited e-mails etc.
My sister's laptop, meanwhile, co-used by two young boys, does have all the latest protection, but has still had a serious problem recently, because young boys, unlike old ladies, aren't cautious or timid in their use of the computer!
I'm probably somewhere in the middle - not as paranoid as my mum, but not as reckless as my nephews. I wouldn't be without up-to-date AV, even though I think it's only ever reported anything twice, in ten years or more.
I think of a bit like house insurance. Every time I'm tempted to forego it, because I haven't had an "incident" in years, I remind myself it only takes once.