Question: suppose the machine is clean of all malware but not in any sense updated, patched, secured etc. Suppose I connect it to the internet from behind wireless router with the intent of using it only on a few trusted sites and only there. Or, for the sake of argument, maybe I wouldn't do any browsing at all, just let it sit there connected to the network. This is all happening in a residential situation with cable internet.

In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?

Answer: 
It is hard to speculate, but let me try. You are asking:

> 
> In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?
> 
> 
> 

Even if the unpatched machine is clean (how do you know? did you do clean install?) it could be compromised again. It would be hard to detect the unpatched machine directly, if it just sits and does nothing (this is not the case if it transmits/receives some traffic). But that doesn't mean that the machine is safe.

Here is a potential scenario in which the unpatched machine can be compromised: If there is a router exploit (it has [happened](http://www.pcworld.com/businesscenter/article/186996/dlink_issues_fixes_for_router_vulnerabilities.html) [before](http://isc.sans.edu/diary.html?storyid=6853)) an attacker could compromise the router and the unpatched machine is an easy target.

Another scenario: a weak encryption or weak password of the wireless router could result in router compromise, and from there the unpatched machine could be compromised too.

And last but not least -- an obvious scenario which was already mentioned: a compromised machine on the local network could result in compromise of the unpatched machine.

As for visiting trusted sites, there were cases in which third-party ads on such sites were [infecting users with malware](http://www.theregister.co.uk/2011/03/25/spotify_malvertisement_attack/), so the machine could be compromised unless Adblock Plus and/or NoScript, or similar are used (but that's part of securing the machine)

Of course these scenarios are not very easy or common, but are possible and have happened before.

There is really no reason to keep an unpatched machine on a network for a long time, behind a router or not.
The second "clean" machine cannot be directly attacked and infected from the internet if it is behind a router but if your first machine has a known malware infection then it is possible that the malware on it could be written to actively seek out other machines on your network and infect them by any means possible.

If there is one machine on your network that is infected then all your machines are potentially at risk, especially if they share data or programs or usernames and passwords.

If this clean machine also has an older or unpatched operating system it makes it more likely that it has vulnerabilities that could be exploited across a home network.

If you only ever go to absolutely trusted sites then you may well be okay but the first site I would go to would be an antivirus site to get some up to date protection.

Until you can clean the infected machine I would only ever have one machine switched on at any given time.