But I do bank online, and occasionally shop on-line so am obviously concerned about security.
And not at all a bad thing. It's more a matter of caution over paranoia.
My own insecurity stems from my complete lack of computing knowledge - other than basic user experience -
We've all been there. What seems easy now or, "Well, duh! Of course you shouldn't have done that!", to a more experienced user is something I and everyone else also had to learn from scratch.
Ads are a particular nightmare! I hate them! Even though I never set my system to open except on a double click - they open sometimes when the cursor hovers.
I presume you don't have Java installed, since by default, it isn't. A JavaScript action (no similarity to Java, despite the name) is most likely what you experienced there. JavaScript does a lot of stuff to make the web more fluid. Like rollovers. For example, if you move your mouse over the lineup of gray boxes across the top of this page, each one turns a darker shade of gray. That's one example of a rollover effect. Note you didn't need to click anything. So a rollover can also be used to trigger a jump to an ad you had zero desire to look at. To block most ads so they don't even load on a page you visit, install either GlimmerBlocker, or AdBlock. Both are free.
Also, I use my macbook air for business and have to check out incoming mail - a lot of it is junk and/or scams but occasionally these are not immediately identifiable so there is always a lurking fear.
That fear is currently moot under OS X. Almost 100% of malware attachments in emails are targeted at Windows users. They can't do a thing to a Mac since they can't run under any OS than the one they were created for. Very rarely, a Mac Trojan will go around as an attachment, but a Trojan has to launched by you like any other app before it can do anything. They can't run by themselves. Just delete them if you happen to get one.
My thinking was that at least an AV would take care of known issues; brand new ones will always be a problem.
Even people in the AV industry are moving away from selling such software. It can only catch known threats. Most anything new flies right through. In short, it's a complete waste of money and only succeeds in slowing your computer down.
But I realise from what you and others have said, that apple's own security deals with the known issues and vigilance is the best practise.
Yup. Using the ol' noggin is still best. The only difficult part for less experienced users is determining FUD (Fear, Uncertainty, Doubt) from actual threats.