You don't need antivirus apps on Android - and, for the most part, those that are available don't actually work due to the way Android runs each app in a "sandbox". One app can't peak inside another app to see its code or what it's doing. They can see the package names of other app, but most malicious apps would pretend to be a legitimate app (with a legitimate package name) and thus wouldn't necessarily get detected. Security apps may provide other useful features like permission monitoring or location tracking of a lost phone, but the antivirus portion isn't realistically be of much use.
Even after the phone no longer receives operating system updates, it still receives security updates through Google Play Services, and Play Protect still functions to protect you from known malicious apps. Don't install apps from outside of the Play Store and you'll be just fine.