My answer will include quotes from others who have answered.
1) As answered, depends on the skill level of the attacker. However, you should treat an attacker as an attacker period. Whether they are attacking via a wireless network, or sending you a client side attack.
On the client side attack, the compromised machine thereby becomes the attacker.
2) Because they are on your machine, nothing is stopping them from installing tools to recover deleted files. You can overcome this by using "shredding" tools.
3) Your OS, Firewall and Antivirus will do little against a client side attack and or malware since most tend to shut them down.
Antivirus is only good for KNOWN threats. If I create something capable of exploiting you RIGHT NOW, no AV in the world knows about it and will not flag it as a threat. I could get into "packers", "obfuscation", etc., but its overkill. Antivirus is not a sure-fire solution.
4) Absolutely. Some of the best attackers are the ones who are unseen. This however, takes a lot of planning, and strategy. In order to even erase their steps, they need to perform certain tasks, which means when gone, there will be residual data however, scripting and scheduling can overcome this.
Now to quote:
As long as you are patched up, there isn't much chance of them getting
on as long as you don't have things open to the local area network.
This is only applicable to a network based threat, where an attacker is specifically AIMING at a target. However, if on the same network, nothing will stop me from say modifying a page he is seeing which can allow me to inject something into the stream (think netsed here).
if your computer is reasonably locked down, then the chances drop to
pretty much zero unless you are talking about a very sophisticated
attacker targeting you directly.
This is far from the truth. Most malware authors bypass a lot of defenses using iframes and other forms of attacks on the "MOST LOCKED DOWN SYSTEMS." This is because the attack vectors are not truly understood. Now remember, this thread is about a WiFi network but the point not being thought of, is the network based attack. If I am on your network, perhaps there is the possibility I can MITM your connection:
You --> wifi router --> Internet --> Google
In this example
me --> ARP POISON --> Router & Clients
me --> re-route everything going out --> from clients --> to me --> to router
You --> open Google --> (what you think is your router) --> me
me --> (here is this quick iframe script using SET (Social Engineering Toolkit)) Here is your Google page--> you
Your machine --> open up a connection to me (game over)