Here is a list of some common ways that computers become infected with malicious software, and whether anti-virus, system patches, or neither of those are effective in protecting against this. As with many questions like this one, a lot depends on the use case.
1) Downloading executable software from the Internet and running it as administrator. This is what anti-virus is most effective at protecting against, but it is far from perfect. Whether or not the system is up to date on patches makes no difference here.
2) Downloading executable software from the Internet and running it as a non privileged user. As of 2019 with normal versions of Windows XP being unpatched for 5 years now, it's fairly uncommon for programs to try to exploit vulnerabilities to gain administrator privileges, but it can happen. Having an up to date system is important in this case. In addition to anti-virus being used to prevent malicious executable from running, anti-virus can sometimes detect if an executable contains a Windows elevation of privilege exploit, but it's easy to fool anti-virus in this case. So anti-virus is only a small substitute.
3) Documents such as Word and Excel documents which exploit unpatched vulnerabilities in Microsoft programs. Anti-virus can often scan these documents for exploits and prevent harm from being done. Since these documents are not executable, the exploit can't hide itself from anti-virus. So anti-virus does help in this case.
4) Remote exploits in system services and the kernel. Anti-virus only scans files in real time, not memory, so it can't help you here. Fortunately, remote exploits are very rare and Microsoft or someone else will probably release a patch even after support is over, as they did with the SMB1 (used by WannaCry) exploit on Windows XP/2003.
5) Internet explorer: Anti-virus doesn't scan memory and can't really help you against a properly written exploit for Internet Explorer. You'll have to find a different browser to use. This also applies to other Microsoft products which connect to the network or Internet. If a security vulnerability exists in one of them, anti-virus can't help you.
6) System libraries like .NET. Programs which open documents and connect to the Internet, such as web browsers, use system libraries that are updated by Microsoft. Many of the updates that you get from Windows Update are for these libraries. The Windows JPEG exploit from back in 2004 was a classic example of this. Many programs which weren't made by Microsoft used the Windows JPEG library to decompress JPEG images. After the vulnerability in the Windows JPEG library was discovered, all of these programs became vulnerable to malicious JPEG images. This is a big gray area. Even if Microsoft doesn't release a patch for a system library, it's usually still possible for the application to patch the problem on their side. If it's a popular program like Firefox that is high risk due to popularity, the developers of Firefox might patch it themselves since they know that Microsoft won't.
In general, whether or not anti-virus is able to prevent you from being infected, anti-virus can still scan your hard drive and clean up infections after the fact, but only if the malware is wide spread enough to be recognized by the anti-virus software, and it doesn't use sophisticated cloaking techniques to hide from the anti-virus. This protects you from simple malware, but doesn't protect you from more directed attacks and more sophisticated attacks. The malware can still steal your information and corrupt your system in between the time that you were infected and the anti-virus cleaned it out.
To summarize, if the use case consists mostly of #1, then having an unpatched system really makes no difference, and anti-virus is what you need, now and in the future. If the use case is #3, then anti-virus is a very effective substitute for patches. If the use case is #2, then anti-virus is not a substitute at all. For the others, anti-virus is not a substitute, but there are work arounds. For #6, it's a big gray area.