If it were a newer version of NT I'd be concerned about USB media, but being NT 4.0 and not supporting USB it's imminently more capable of being air-gapped than later versions. (I recall a fun Ed Skoudis quote-- "At best, an air gap is a high-latency connection". Evidence Stuxnet.)

The auditor probably doesn't know nor care. "Every windows machine runs antivirus" is a checkbox item, zero thought involved.