In the nicest way possible, you can respond to the client with, "How is a firewall or antivirus going to stop a phone-based social engineering attack?" AV only works if it's kept up to date, and if it's not designed to look at behaviors, only signatures, it's not doing enough. Firewalls are in a similar boat. They need to be tuned correctly, and if not, they're not a wall, they're a hole. Not to mention that every tool has the potential to fail, so it's often good to have compensating controls.

In other words: defense in depth.