Clamav is ok to use for scanning files for malware. If you want something to detect behavior you can use Falco or tetragon to log events on your system. Those systems are best used if you send them to centralized log system but that’s complete overkill for personal use

This and avoiding taxes are the reasons why your tea is in the harbor

It’s gotten significantly better with containerization technologies like oci containers and flatpak. Yes it uses more storage, but the drive space pretty cheap