What most people don't understand is that putting a malware/virus programs on Android is more to prevent virus' transferring to a computer with Windows on it. Just like if you had a Mac networking with a Windows computer, you would need a Virus program on a Mac to prevent transferring a virus to Windows.
Do you need a virus program? That question is still being debated. Most experts argue about if it is really needed for Android or not. This again is up to you to decide. Having it on your device, if you choose the right AV program, won't slow down your device. I use Lookout, which is free, and doesn't slow anything on the phone down, and does more than just being a malware protector. It has a locator and file backup to servers.
I somewhat disagree. First of all, people tend to be a bit constrained in their use of the term "virus" - for most a virus also includes malware which exists for every platform under the sun. Unfortunately many virus scanners are themselves malware or simply out of date. Here are two simple tips for any platform (including iPhone's walled garden where they nicely trap the bad guys inside as well):
1. Only download apps that have a lot of downloads and a good rating or from developers that are trusted.
2. When the app installs and it says it wants to access certain parts of your phone, PAY ATTENTION! I downloaded a well-known app with decent reviews but it wanted access to my contacts and other parts of the phone that it shouldn't need access to. Delete.
Obviously if you've rooted your phone you've also got bigger things to look out for. Once you've got root access, apps may be able to get root access. Generally this is something they need to ask for, but if you don't know what you're doing with root it's a dangerous thing to play with.