None. Google Play Services already has a built in malware scanner.
If there's apps that came with the phone which you can't uninstall/disable, you will need to use ADB: https://www.xda-developers.com/uninstall-carrier-oem-bloatware-without-root-access/
What about for people like me who download a lot of APKs?
I don't want any security software as I don't need it but the OP might also download APKs
It checks your device for potentially harmful apps from other sources. These harmful apps are sometimes called malware.
The scanner is on the phone itself, it also scans sideloaded apps: https://support.google.com/googleplay/answer/2812853?hl=en-GB
I've had it triggered a few times when I was experimenting with Tai-Chi, which allowed certain xposed apps to work without root.