So far we have:
- people who read blogs
- AT&T sales persons
- folks who make money by selling Android anti-virus software
- people who think coding in Java makes something secure
- people who type in red
- people who worry about the number of apps sold by Apple
I'm gonna go out on a limb and say I might be an expert. My bosses seem to think so, but I hate labels. Anyhoo, I spend 12-15 hours per day, 7 days a week, working with Android devices. Have been for the past 2+ years. I probably know as much as the AT&T guy anyway. I'll try to make this as boring, but plain as possible.
There are no viruses for Android. A computer virus replicates itself inside new pieces of code. Sharing an infected Giant Jiggly Boobs live wallpaper you downloaded from a cracked apk website does not make it a virus.
There have been instances of applications with malware inside them.
There have been instances of apps in Google Play (as well as Apple's appstore, but that's neither here nor there) with malware embedded.
I define Malware as something harmful to your Android device or personal data. People who have something to gain from malware scanners and sensationalism count things like ads and push ads as malware.
Improperly coded apps can allow other apps to gain permissions that they have not declared. An app could have access to your contact data, and store its own data in an insecure way, then other apps could read this data -- without asking for permission to read your contact data.
By my count, I have installed over 250,000 Android applications. It's part of what i do for a living. I have been hit by malware once -- but not from Google Play. It was from an alternative, but legitimate "adult" Android store. (I love my job). The owners of said store worked with me to find the offending app and remove it, as well as ban the publisher from their store.
Anyone who claims they are safe because they understand permissions is lying to themselves.
Anyone who claims they are safe because they only install apps from Google Play is lying to themselves.
A person who says they read permissions, only download from official sources, AND use common sense/read reviews/don't try to get something for nothing are likely safe.
If you download apps from websites that host cracked apps, you ARE infected. I've torn apart hundreds and hundreds of apk files from these places, and 9 out of 10 of them have extra software inside.
Using a security app won't hurt your Android device. Using common sense won't hurt your Android device. Using neither will.