The state of Android antivirus apps is dire. As in they have very bad record when it comes to simply detecting much at all.
However I had Avast Mobile Free (not sure if paid exists) installed from Google Play. Well I did right up until it launched a popup advertising another application by Avast with no user input at all.
This is exactly how a piece of malicious software might behave albeit that presumably buried in the Avast EULA that I failed to read there's a clause that I agreed to so I uninstalled it.
ES Explorer then immediately claimed to have found 1.5GB of junk it needed to clean. Wierdly it cleaned it then claimed it was back some time later and cleaned it again.
Screw you Avast.
I don't use antivirus on my phone or tablets. and only use windows defender on pc.
don't do stupid shit and you wont have a problem.