On Android, it's fairly hard to get malware, and requires a user action 99.9% of the time by installing nefarious software. So you are the best antivirus for your phone. If you are using a computer, I would most definitely have anti-virus on it. After following a security podcast for a bit, it's a wonder Windows and programs running on it aren't worse off with all the big threats popping up.
VPN's are a good idea if you use public Wi-Fi hotspots, or any other network you don't control such as a friend's private network. Just because a Wi-Fi network is password protected doesn't mean the data transfers are encrypted and safe from snooping. I would also stick to the well known paid VPN services, as the free ones aren't as private as they claim (they make money selling your data). If you only use your personal, password protected Wi-Fi network, or your mobile carrier's network, then a VPN is about useless for the average person.