Just use a firewall, and antivirus, and don't use IE, and disable autorun. Then out-of-box XP SP3 runs just fine and is secure.
I always turn off autoupdates because:
1. Update-on-shutdown sometimes hangs and corrupts system.
2. They interfere with Anti-WPA. (remotely disabling Windows)
Updates might matter at multi-user installations or when there is no firewall.
Non-IE browsers still have vulnerabilities. And that's without taking exploits in third party plugins into account (Flash and Java being two popular vectors for attack)
Most antivirus solutions are notoriously bad at new threats and while firewalls might highlight malware trying to phone home, by that point you're already infected.
Security is only as strong as your weakest link and thus OS security updates are as vital as updates on any other part of the software stack.
And don't think common sense will save you as ad banners are sometimes known to be boobytrapped; legitimate sites get hacked to serve malware too.