Yes. The Windows instance running in XP mode doesn’t share any of the security software, settings, patches, etc. with the host Windows. You need to have a separate copy of your anti-virus/anti-malware/firewall running.
"Personally, I would say it is required. The VM machine is effectively running a PC by itself.
Thought, I've not tried this: But one way to test it is once the XP-VM is up and running, first in your real host PC goto the EICAR test page and run or open their 'test virus' test string. Your AV should detect it. Now do the same in a browser in your XP-VM, does your host PC AV now also detect it?
I suppose the issue is what do you want to use the VM for? anything where you require to protect data, I'd say yes. If you are happy to just re-install it if it does get infected, then no. Your host AV should still protect the host even if it doesn't protect the guest. Personally, I say it does need one."