It doesn't matter how up to date a machine is...
...if it's not connected to the internet.
Forget the cost of new hardware/anti-virus. What's the cost of employees wasting time?
I've got several consistently underperforming help desk staff on final written warnings for watching YouTube playing browser games for hours on end. Now they'd rather stare off into space than use remedial training materials to become competent.
2 of them have even gone to HR to complain about how unfair it is to expect them to do what they're paid for!
The cheapest solution is to run 2 networks and have most devices have no outside connection.