Do they need to be separate? No, but it's a bad idea to only rely on perimeter security and do nothing on the endpoint. The question comes down to defense in depth. You can put AV on the firewall, which will do a decent job of catching malware as it comes in via the web. That, however, won't do anything once malware is inside the perimeter, such as malware introduced via a thumb drive. Also, unless you have a segmented network, a network worm (once introduced) would have very little to stop it from infecting every device on the network if you don't have endpoint AV active.
You don't want to go crazy with security tools; each added tool has a performance, administrative, and cost impact and eventually you can wind up with multiple tools working at cross-purposes. However, adding AV to your firewall is a good step and can help protect your endpoints from malware traversing the firewall. Like any tool, it's never 100% so an additional layer (AV on the endpoint) is needed to cover what the firewall AV allows by.