People are looking to replace their firewall, or add in-line antivirus, or are looking to add intrusion prevention systems. They typically deploy with one or two services activated, and slowly migrate to new features.
Vendors are concerned with the alarming rate smart phone viruses are starting to come out now.
We're today at the point where we have antivirus fast enough so that it can be bundled with a firewall. When you get to multiple features you can see performance start to be impacted.