Firewalls are normally handled by the provider, antivirus and antispyware is up to you. Because only you can upload files - at least when you don't use the VPS to browse the Internet - it's normally not required.