A virtual machine, XP Mode or any other, is as any other computer. It needs to be protected. A virtual machine can not access or use the security solutions you have installed on your host. Basically, it's like having two computers in a network; it's not enough to protect computer 1 (in this case the host machine, Windows 7), but leave computer 2 (XP Mode in this case) unprotected.
I'm using Microsoft Security Essentials as antivirus solution on all my virtual machines, combined with Windows Firewall. MSE is free, quite good and light weighted, it does not use too much of your virtual machines resources.