Yeah, that does bring up a question. How much are the apps offered at the Play Store vetted to prevent exploits? And no, I'm not inclined to just load stuff in helter skelter from basically anonymous sources.
Which brings up another question. What are the major security holes in these devices? I do not intend to do much in the way of internet browsing with it. But do firewalls need to be installed on them to protect against direct intrusions?
In all honesty, the security aspects of Android are well above my pay grade, so take this entire post as nothing more than anecdotal opinions. In the decade or so that I've been using Android, I've yet to have a single virus-type issue with any phone, and I've had a pretty cavalier attitude about just trying things and seeing what happens. Samsung does use a security platform called Knox, which seems to be pretty highly rated.
Here's a for instance regarding Knox: when I rooted my S7, it required flashing a custom "engineering" bootloader to the phone which would set the stage for even allowing me to subsequently flash the actual program that gives root access. After changing bootloaders, it would give an impossible-to-miss security notification every time it boots up. The flashing software I use is called Odin, which, I think, is basically what Samsung uses to load firmware at the factory. Without Odin (or installing a custom recovery), I doubt it'd be a remotely simple matter to even make such significant and potentially dangerous changes to the modern Samsung flagship devices.
If you look hard enough, I'm sure you could possibly dig up someone who's actually had some sort of infection on their phone, but in all my years of nonchalantly taking chances, I've never really had any problems that didn't stem from simply not sweating the minutiae of whatever I was trying to do. IMO, if you're never intending to get into the modding scene, you probably don't really have much to worry about.
The Android wizards at the XDA-Developers website I linked you to would be able to give much more knowledgeable answers about these advanced subjects than I could ever hope to. If you find yourself with some time to kill, it may be worth browsing the non device-specific sections of the website and looking into general Android security.
Addendum: I think that the main "security" complaints/concerns probably stem from app permissions. When you install an app, it'll show you a list of all of its required permissions - everything that it can directly access. Like, if you're trying to install a stupid little calculator app, it may be a bit fishy if it requires access to your GPS location and contacts list. With anything Google, I suspect that there's some degree of collecting/selling certain data for advertising purposes and such. Although I never give them a second thought, you may want to make it a point to keep an eye on what any given app needs to access.
+1 for XDA developers
+1 for rooting
Not real crazy about TouchWiz either.
I am/was a bit of a rom (read only memory) junkie, at one point in time I was flashing a different rom twice a week. I have never seen any type of virus on any of my devices, however I have had to fix two devices that picked up ransom wear. Both people admitted that they downloaded an attachment off of a website (xxx). The attachment was an app disguised as a picture attachment. This is where safe mode can be useful, especially if you don't have a pc to do diagnostics with.
CyanogenMod (no longer exists) was my favorite daily rom, great on battery life. LineageOS is basically the new CyanogenMod.