A software firewall only protects your data on your computer, and anti-virus software only protects you from, well, viruses. Neither protects your data as it flows over your local network, at a Wi-Fi Hotspot, or through your ISP. Without a VPN, your data is completely exposed and can easily be monitored and captured.
As laptops, smartphones, and wireless networks have grown more popular, a great deal more data has become a great deal more mobile. Your ISP, search engines, and every website you visit captures and stores information about you. It is more crucial than ever to protect your data, as well as your identity and privacy, with a VPN.
For a MUCH more complete answer, see the section, Why do I need a “personal” VPN?