Short version for heartbreakdoctor: no, you probably don't need these things for N900, but always try to be aware of what your phone is doing (cos it's also a computer)

Not a good assumption. While I don't run a firewall or antivirus on my N900, it is totally wrong to assume or claim (even implicitly) that Linux is somehow magically immune to the stuff which causes you to need antivirus and (particularly) a firewall. There aren't lots of Linux virii out there, but today might be the day that someone puts together an exploit for N900 (probably including some social engineering to get easy elevation to root) to harvest personal info, for example.

It's true that mass exploits, viruses, botnets etc. etc. are mostly a concern for Windows users (weak OS with massive user base makes a juicy target), but Linux is not flawless, and exploits are out there. If you were running mission-critical services on Linux (e.g. most Fortune 500 companies, most top universities) you'd have a firewall, network and software security audit/policy in place... right?

Having said all that, the majority of N900 users probably don't have anything in place for either firewall or anti-malware. Many users will agree that you're far more likely to screw up your N900 by installing some package or other which either has a bug or conflicts with something else (as opposed to some malware/whatever). So, err... beware of extras-devel!