Do Android phones need antivirus

Android has Play Protect built in. It scans apps from the Play Store before and after installation, and it catches a great deal.

Where the gap is

Play Protect is strongest on apps that came from the Play Store. Sideloaded apps, and apps from third party stores, are exactly where the risk concentrates, and exactly where its coverage is thinnest.

It also has nothing to say about a phishing link in a text message, which on Android is now a more common way to lose an account than malware is.

What to actually do

Leave Play Protect on. Add filtering that works on links rather than apps, and check whether your email address is already in a breach. Those two cover the ways most people actually get caught.