Saying you haven't encountered malware seems like a weak argument; a tech-savvy person (which you are, since you're here) will know not to download dodgy stuff and not to click dodgy links on emails or porn websites.

A less technically-inclined person won't know, and will definitely end up exposed to malware. That's just reality for Windows users.

The key argument is that Windows's built-in antivirus is quite solid now. I don't know if (and I don't think that) a modern antivirus provides any -significant- additional protection over what comes with Windows by default.

For enterprises they provide additional compliance and reporting functionality and since people aren't admins on their machines infecting machines can be quite hard, probably limited in time to one user session.