Anti-viruses are a scam and always have been. They aren’t much more than security theater and box ticking. Don’t get into the mindset that you can outsourse security to a single product. Security is something that happens in depth. The more intrusive av software can itself become an attack vector as it often runs with lots of privileges.
Distros operate with webs of trust and cryptographically signed packages. Your distro installer verifies the integrity of the package. There is no need to check a third party signature database. It adds no value. Even well audited software could contain hidden vulnerabilities so increasingly we are running software with less capabilities via systemd, flatpak/brwrap or in containers. The environment is very different to the origins of av software on Window 9x where people would download random unsigned executables to a system with no privilege restrictions.
There are lots of challenge for the FOSS community. We love features and freedoms and those features and freedoms sometimes make security more complicated. We need to show more restraint packaging software like ssh and not add so many patches and additional dependencies. We also need to show more restraint in the typical rust, go or javascript project where adding dependencies is so easy we end up sometimes including hundreds of them for stupid crap like coloured messages or being able to handle a dozen config file formats. I don’t care about your garbage collection or advanced compile time checks, if you include hundreds of crates from other developers you are no better than npm and I would put more faith in a 20 year old c library.