Today's malware often is a delivery mechanism for a multi-pronged attack that looks for program/os vulnerabilities, service vulnerabilities, share points, etc. From the initial machine infection, it can try to push infection agents to either actively or passively attack other machines on the network through various vulnerabilities.
In your scenario, it is more likely that someone will infect another system that then attacks the vulnerable system. If the infection is a remote access trojan, the person can also actively see all the machines on the internal network. Other malware can also do a network scan and phone home with information.
On an internal windows network where file sharing is being used, an unpatched machine can be attacked through three separate vectors.
1)Share points that have the trojan dropped in place with an autoplay. Your machine is infected either by direct execution or an autoplay being triggered. Don't enable the Microsoft Client to access other computers on the network on the outdated system.
2)Vulnerable services can be scanned for and the machine attacked through them. Don't run any services that listen on the network on the outdated system.
3)There's no such thing as a trusted website anymore. Most of your attacks will come through Acrobat files, Flash content, Java applets, etc. The browser itself, being unpatched if IE will be another major source of attack, especially if it's IE6. Keep the websites you visit down to corporate sites that have a lot to lose if they ever get compromised. Blogs are never trustworthy, you can't depend on the person running them to be aware enough to patch before compromise. I've gotten pretty used to the Kaspersky pig squeal in the last year.
Now from the most likely attack to the less likely attack.
As to "Behind a wireless router", what encryption level are you running? If you aren't running WPA2-AES, get a router that will run it and passphrase protect the network so that it's easy to connect other systems, but hard to break from the outside.
With NAT on the router and the unpatched computer accessing the network, all an attacker should see when this computer is generating traffic is your router IP address and a port number. Don't port forward anything to this system.
And now where NAT can allow information leaks. Whether this is Linux, Windows or MAC, there are certain intranet protocols that MUST BE BLOCKED from passing through the router to the public network. I've seen routers pass Microsoft File and Print sharing traffic outbound, DNS traffic from internal name resolution that gets passed outbound. From this traffic and a packet sniffer, it is possible to build an internal network map of the private network addresses being used and by the packets, attempt to fingerprint the OS generating them if that information isn't spelled outright in the packet.