For the purposes of this answer, I am interpreting the question as focused on what has changed about running Windows XP on April 7, 2014 vs on April 9, 2014. To put another way, I am not going to speak to the myriad of advantages and disadvantages that were true on both days, but rather what specifically changed about Windows XP security on April 8th.
So, from that perspective, lack of patching capability is the security issue with XP post April 8th, and it's a major one. No, running "good" anti-virus software and a third-party firewall won't make up for it. Not by a long shot.
Security is a multi-faceted problem. "Being Secure" involves using encrypted communication channels (https), running active monitoring/detection software (anti-virus/malware), only downloading software from trusted sources, validating signatures on downloaded applications, avoiding notoriously weak software, and updating/patching software promptly.
All of these practices and products taken together can be called security hygiene and, in the case of Windows XP, you can continue to practice all these things except for one: patching, but it won't help.
Why Patching Matters
Therein lies the first and most critical problem. Aggressive patching is the absolute most effective practice of all, and this is why:
- Anti-virus fails at alarming rates, 40% according to this study. Plenty of others abound. Detection is still mostly based on fixed signatures. Remixing old exploits to evade detection is trivial.
- Firewalls do not stop what users let in. PDF, Flash, and Java: the Most Dangerous File Types are all invited right through the firewall. Unless the firewall is blocking The Internet, it's not going to help.
Running the latest anti-virus and firewall just doesn't do much. That's not to say they aren't effective in combination with all the above hygiene, and anti-virus will eventually detect some exploits as they age, but even then trivial repackaging will evade detection and the underlying exploits will still work. Patching is the foundation of a good defense. Without patching, everything else is just gravy. The vast majority of malware depends on unpatched software to succeed:
How the most common cyber exploits could be prevented (2011):
One of the more disturbing, although not surprising, findings was that the top 15 vulnerabilities being exploited by observed attacks were all well-known and had patches available, some of them for years. The Office Web Components Active Script Execution vulnerability, No. 2 on the hit list, has been patched since 2002. The top vulnerability, in Microsoft’s Internet Explorer RDS ActiveX, has been patched since 2006.
Interesting Analysis on Patching and Attacks:
“In this supplemental analysis, zero-day exploitation accounted for about 0.12 percent of all exploit activity in 1H11, reaching a peak of 0.37 percent in June.”
“Of the attacks attributed to exploits in the 1H11 MSRT data, less than half of them targeted vulnerabilities disclosed within the previous year, and none targeted vulnerabilities that were zero-day during the first half of 2011.”
In other words, the vast majority of successful exploits are only possible because people did not apply patches when they became available. Even now, the majority of the successful Java exploits are against vulnerabilities that have been patched, users are not updating. I could post dozens more research papers and articles but, the point is, when vulnerabilities are known and patches are not applied, that is where the damage increasingly comes from. Malware, like any software, grows and spreads over time. Patches inoculate against old malware but, if patches never come, the environment is getting increasingly toxic by the day, and there is no cure to be had.
Without patches, zero-day vulnerabilities are never closed, they are effectively "zero-day" forever. As each new vulnerability is found, malware authors can spin new minor variations to avoid signature detection, and the OS will always be vulnerable. So Windows XP will become less and less secure over time. In practice, this will look a lot like what we see in the above GCN report among the 40% of XP users in 2011 who hadn't even installed patches from 2002 (so, post-April 8th, that will be 100% by definition). Compounding the problem will be the fact that malware authors are already focusing on XP again, knowing that anything they find will remain valuable and exploitable long term.
In the age of always/frequently-on, always-connected devices, aggressive and frequent patching is a base requirement of any OS.