From my understanding and experience with Virtual machines, they usually need seperate security measures. Seeing that they are "bypassing" antivirus software firewalls of the host PC / Server, you'd want Antivirus / SW-firewall on both the HOST and the vitual pc / server.
A Physical Firewall placed before the gost would cover both the host and the virtual pc/server, because all network traffic passes through it.
This article covers mentions that exact issue
Woodgate noted that XP Mode isn't a security solution. Indeed, to protect their systems, users will need antivirus software running both on their Windows 7 desktop as well as a copy running inside their Windows XP virtual machine.
Also check out this blogpost concerning security of XP-mode in win7
The problem is that Microsoft are not providing management around the XP mode virtual machine (VM). This creates the potential for a security disaster. XP mode is an independent Windows instance, that shares the odd folder and device with the host Windows 7 installation. What it doesn't share is processes and memory. So it doesn't share security settings, security software, patches etc. It does not inherit any security from the host. When you use XP mode, you need to patch the copy of XP as well as the host Windows 7. You need to manage settings separately, configure two personal firewalls and install and manage two copies of anti-malware software.
This would mean having 2 seperate liscences for software, unless the specific software vendor has a liscencing scheme that covers virtualization. This may probably become more popular* now that Win7 is going to havebuitl in XP, since users will expect liscences for both operating systems.
*: Assumption on my part, no facts to base this upon! :)