Well actually, I think there's two schools of thought.
One school adopts the adage "if it isn't broke, don't fix it". In other words, if you can function with Windows XP and no service packs, then don't install them. In fact, service packs constitute about 80% of the functionality of Windows. I'm surprised nobody's come up with some hack that just takes a service pack and gives you a complete Windows XP install!!
I digress.
The other school subscribes to the philosophy that you need to install anything Microsoft says you need to. They're probably the people who were duped by all those Microsoft-like spam mails which resulted in widespread worm and virus infections.
If you're browsing the web then you need antivirus and firewall. You can optionally install some spyware/adware detection software to make sure you've got an optimum connection to the Internet. SP2 provides an enhanced firewall amongst other things. But even that's come under some scrutiny. Best stay with a 3rd party for that kind of stuff. Microsoft's attempts at in-house antivirus and security have largely gone by the way-side so don't rely on them too much. Educate yourself or keep an eye on the AAM IT discussions!