I've had a couple HP iPAQs running Windows Mobile, including my current phone.
If you're going to fairly standard websites (most of which are probably the mobile version, since standard website browsing is kind of annoying on the small screen), then I wouldn't worry too much about virus protection. CNN, 986Forum
, and the like aren't going to load you up with nasty stuff.
Your number one area of concern should be locking down things like your bluetooth connection with really good passwords and connection approval requirements. Airports, malls, etc are great places to have someone browsing through your files or trying to use your phone as a modem. I'm not sure of Motorola, but a lot of pda vendors still ship their phones/PDAs completely wide open. Bad news if you use bluetooth for something like a headset and have important info on the device.
Oh that and actual theft. Don't put it down. Anywhere.
My approach with my PDAs is the same with all the computers I've ever worked with... Lock it down, don't visit sketchy websites, delete the email first and ask questions later, the music downloading program is making money from things it is doing to your computer and that's why its free to you, and the only prize you're going to win by clicking a banner advertisement is one you don't want. ;-)
With this, the only things virus scan has ever found were old Word macro warnings and software that I purposely installed or wrote.