Let's say I buy a computer and use the internet for services but rarely download anything and when I do it is from legitimate sources with a minimal to non-existent chance of malware.
What benefits can an antivirus program provide me other than detecting or preventing those few downloads from containing malware?
Or I guess more generally - Is antivirus needed if a computer doesn't download files but only uses web applications?
Of course, you will always need an anti malware program even if you do not download files by yourself. Why ? Because a simple visit to the most innocent website you know, may trigger an attack and install you malware (more likely spyware) that can lead even to a total control of your machine.
I advice you to read about drive-by download attacks that can exploit the vulnerabilities of your browsers and or their plugins and install without your consent or knowledge more or less dangerous malware.
When is an antivirus program needed/useful?
As I said, always. Unless if your computer is totally disconnected from internet and you never use any external media (USB sticks, external HDD, CDs ...) to read data (in which case, your computer is useless)
An antivirus program is always useful. The problem with your logic is that you're assuming that you are in control of everything that is downloaded to your machine. Using web applications will invite all sorts of different possibilities into the mix.
Unknown Downloads
Lots of different things are downloaded to your machine without your knowledge. I just recently visited a site for holiday shopping and SilverBells.wav was immediately downloaded to my machine without any kind of prompt. Data masquerading as session cookies, images, all are downloaded without prompting to the user.
"But I don't run the browser as an administrator, how can malware do any damage without privileges?"
It turns out that Malware really doesn't need very high privileges to get its job done. Any kind of initial foothold into the system is all it needs to run rampant. It might not be super advanced, and hard to remove. But the annoying Adware types usually don't care all that much.
Browser Exploitation
Browsers are large applications with tons of attack vectors for exploitation. See my answer here that includes links to the main browser security bug fixes. You don't even need to visit a malicious site if an ad somewhere contains a piece of code to exploit the browser. In these cases files can be downloaded to your computer, or browser extensions can be installed; all without your knowledge or consent.
Web Protection
Nowadays antivirus products are a lot more than just scanning your system for malicious pieces of code. A lot of times now they provide real-time web browsing analysis. If a malicious script is running on a web page it will alert your first before displaying the web page itself.
They can also scan for malicious URLs and possible phishing attempts. Just because it's displayed on Google doesn't mean that you should click it. Some phishers will do a lot to push their website up the chain of Google returned searches.
The bottom line is that there is a lot more out there to worry about than just downloading files when it comes to malicious pieces of code. Using an antivirus program is always suggested; better to have it and not use it than unprepared.
An antivirus may help against malware that exploit vulnerabilities to install themselves without user interaction, like browser vulnerabilities, PDF viewer ones, Flash player or Java plugin ones, in which case the antivirus would prevent the payload from executing.
This of course assumes the payload is already known to the antivirus, which isn't the case with a brand new virus or a targeted attack.
Since there are free and non-intrusive antivirus software such as Microsoft Security Essentials you may as well install it, every bit of protection helps.
In the year 2015, most malware will spread via two mechanisms, the primary being USB (or derivative, which nearly all hardware is) and the second being TDS (often a combination of adware, parasite hosting, and blackhat SEO) via exploit kits. Yes, the second vector is over the web and the targets are browsers and browser plugins especially Java, Flash, and Silverlight applets. Neither of these require you to download anything!
You can't stop either of the above attacks with antivirus, however antivirus is still very important to have installed regardless. There is one technique (available via at least one free tool that I know about and one commercial product) that provides near-complete control over infection. This technique is exploit protection in the form of advanced canaries and ASLR such as provided by Microsoft EMET or Invincea Freespace. Many in the security industry will claim that these can be bypassed -- and while there is truth to this, it often requires knowledge of the target environment that goes beyond what exploit kits currently allow.
Let's pretend that you do have an advanced piece of malware that uses a hardware vector or an extremely-advanced web vector. Antivirus, such as McAfee, will not catch the malware -- but it can help a forensics investigation. Not only does McAfee leave behind BUP files that can be analyzed, it also can leave event logs or other artifacts that leave a trail of malware behaviors available to an investigator.
Summary: Install Microsoft EMET, configure it for maximum security adding all of your browsers and browser plugins, and advance its configuration further with tools such as EmetRules. Also install antivirus -- my recommendation is McAfee because forensics investigators are familiar with it -- and it appears to be useful during after-the-fact investigations because of its logging capabilities. If you are very worried about malware spread via hardware means, then do not plug hardware such as USB (any, not just flash drives), CD/DVD media, or SDcards into your computer -- and protect your computer by removing or epoxying (i.e., gluing shut) these hardware components.
Visiting shady websites and downloading files are common ways that a computer could get infected, but they are by no means the only ones. Drive-by downloads that exploit vulnerabilities in the browser, operating system, or plugin (Flash, Java, etc.) can infect your computer if you merely visit a malicious webpage, with no other interaction on your part and no indications that anything was downloaded.
Even big-name sites can sometimes spread malware. For example, earlier this year researchers found that some Youtube ads were linking users to drive-by downloads and infecting anyone who clicked on them with a banking trojan. The drive-by download relied on zero-day exploits in IE and Flash, so people who were infected would see no indication that anything malicious happened.
Then there are viruses that spread via infected USB flash drives, over the local network, etc. etc. In short, visiting only major websites and downloading from legitimate sources will reduce your chances of getting malware, but it does not mean that you can skip installing antivirus.
