It probably is very rare, but in 2016 I got a virus on my new Galaxy Note 5. I hadn't gone anywhere shady. I took it back to Best buy, and Verizon replaced it. So it's not impossible to get a virus from legit websites. And I was using the Verizon antivirus at the time.
Also, as of late there...