Explanation/Reference:
http://howexchangeworks.com/2013/06/connection-filtering-in-exchange-2013.html In Exchange 2013, the anti-spam agents can only be installed on the Mailbox role. But, the connection filtering which is very useful in fighting spam emails is not available in 2013.
Same goes for the attachment filter. Even though CAS proxies emails back and forth (if setup correctly), it is a stateless proxy and can't have any anti-spam agents on it.
http://www.jaapwesselius.com/2013/01/10/installing-exchange-server-2013-part-iii/ In Exchange 2013 the anti-spam functionality (through protocol agents) is running on the Mailbox Server and not on the Client Access Server so all mail, including all spam will hit the Mailbox Server when installed in a configuration as outlined in these blog post series.
The anti-spam functionality is enabled using a Powershell script (.\EnableAntiSpamAgents.ps1) and offers Sender and Recipient filtering, content filtering,
Sender Reputation and Sender ID filtering. To activate the ant-spam agents on the Mailbox Server open the Exchange Management Shell and enter the following commands:
CD $Exscripts.\Install-AntiSpamAgents.ps1
http://www.tlglearning.com/LinkClick.aspx?fileticket=dnonu0glRr8%3D&tabid=238 You can't enable the anti-spam agents on an Exchange 2013 Client Access Server
http://social.technet.microsoft.com/Forums/exchange/en-US/5c9f1b51-4a93-4de4-964e-1f53afbb8e8b/ how-toconfigure-attachment-filter-agent-on-exchange-2013-
The Malware Filter runs on every 2013 Mailbox server to protect against malware and viruses.
http://blogs.dirteam.com/blogs/davestork/archive/2012/12/06/exchange-and-malware-protection.aspx