Do I need ANTI_VIRUS=1 in my site.cfg or go.user for anti-virus features to be enabled?
No, this is the default if you are running Classic or Classic HPO with current maintenance AND you have a supported Anti-Virus product installed. LISTSERV checks for Windows Defender when it starts (for non-Windows installations, through the AVS if you are using it).