I also disagree on points 1 and 2 but for different reasons.
We're still going to need antivirus as long as less computer literate people download and run random executables. Gaining root or administrator privileges isn't necessary for the common tasks that malware does such as spending spam or getting the user's usernames/passwords/credit card details.
Also, despite its stronger security model, all it takes is one script that runs as root to have the wrong permissions set, or to read/execute other executables which have wrong permissions and you've got root. I'm not sure if the common packages on standard Linux desktop machines are configured correctly out of the box (I'd hope that they are), but this is worryingly common in corporate/enterprise environments. There are also bugs in other packages (including the kernel) which can be used for privilege escalation through buffer overflows, etc (although these tend to be patched fairly quickly)