Using an antivirus on your phone is like wearing a life jacket while taking a bath.
I'd say it's more like wearing a newspaper sailor hat while flying a plane. It's worthless, makes you look silly and has no impact whatsoever on the safe operation of the task at hand. Your analogy made it sound like overkill, where it was too much protection. In reality antivirus programs offer either no protection or worse, they themselves are the major compromise to your system.
The major steps to security and privacy are as follows:
1. Don't install apps from any unverified source, installing via the play store is always best. Also stay off of free stranger Wi-Fi unless Google's connectivity stuff is doing it via their VPN.
2. Don't ever install anything from Cheetah Mobile or similar companies, these apps are malware/spyware.
3. Don't buy phones that aren't guaranteed to receive monthly security updates.
4. Don't buy phones that aren't running the latest version of Android
5. Don't root
6. Don't use a microSD card. Not using it at all is best, but if you must, use adoptable storage with encryption.
7. Read the terms and privacy policies of the apps you are going to use and understand how they're using the data they ask to access.
8. Don't leave your device physically accessible to thieves and criminals.
9. Don't install any apps that you believe will give you paid content for free.
10. Uninstall all apps that serve ads without a way to turn them off in settings or via a purchase.
11. Uninstall apps you don't actually use.
12. Don't install apps from devs until you know exactly what you're getting and what they are getting out of it.
In short, keep your guard up. The basic security in a fully updated Android OS and the play store will do 99% of the work and the last 1% is just vigilance. But a user can undo almost all of Androids built in protection simply by circumventing them, such as rooting, installing apps from shady sources or shady devs on legit sources, etc. Vigilance.