Question: suppose the machine is clean of all malware but not in any sense updated, patched, secured etc. Suppose I connect it to the internet from behind wireless router with the intent of using it only on a few trusted sites and only there. Or, for the sake of argument, maybe I wouldn't do any browsing at all, just let it sit there connected to the network. This is all happening in a residential situation with cable internet.

In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?

Answer: 
It is hard to speculate, but let me try. You are asking:

> 
> In this situation can a remote attacker somehow detect the fact that the machine is connected to the internet and try connecting to do an exploit?
> 
> 
> 

Even if the unpatched machine is clean (how do you know? did you do clean install?) it could be compromised again. It would be hard to detect the unpatched machine directly, if it just sits and does nothing (this is not the case if it transmits/receives some traffic). But that doesn't mean that the machine is safe.

Here is a potential scenario in which the unpatched machine can be compromised: If there is a router exploit (it has [happened](http://www.pcworld.com/businesscenter/article/186996/dlink_issues_fixes_for_router_vulnerabilities.html) [before](http://isc.sans.edu/diary.html?storyid=6853)) an attacker could compromise the router and the unpatched machine is an easy target.

Another scenario: a weak encryption or weak password of the wireless router could result in router compromise, and from there the unpatched machine could be compromised too.

And last but not least -- an obvious scenario which was already mentioned: a compromised machine on the local network could result in compromise of the unpatched machine.

As for visiting trusted sites, there were cases in which third-party ads on such sites were [infecting users with malware](http://www.theregister.co.uk/2011/03/25/spotify_malvertisement_attack/), so the machine could be compromised unless Adblock Plus and/or NoScript, or similar are used (but that's part of securing the machine)

Of course these scenarios are not very easy or common, but are possible and have happened before.

There is really no reason to keep an unpatched machine on a network for a long time, behind a router or not.
Whether a computer can be discovered behind a router has nothing to do with whether it is up to date and properly patched, but whether the router will allow it to be accessed. The [network address translation](http://en.wikipedia.org/wiki/Network_address_translation) and firewall provided by the router may provide a (small) degree of protection against the system, but it is still relatively easy to detect and exploit the vulnerable computer.