VPN vs antivirus: which protects against what

Antivirus and a VPN protect different things. Antivirus looks at what is on the phone: the apps you install and the files you download, checking them against known malicious patterns. A VPN protects what is in transit: it encrypts the traffic between your phone and the internet so the network cannot read it, and hides your address from the sites you visit. One does not do the other's job, and a phone that needs one does not necessarily need the other.

The split

The rows with "No" in both columns are worth a look. Neither tool helps with a password you typed into the wrong page, and a good deal of real-world harm arrives that way.

What antivirus does on Android

Android apps run in a sandbox, each with its own permissions, and cannot read one another's data or the system without being granted access. That already removes most of what desktop antivirus historically dealt with. Google Play Protect scans apps on the device and in the store against known malicious behaviour, and it is on by default.

A separate antivirus app adds scanning of downloaded files, sometimes a list of known phishing URLs, and sometimes app-permission auditing. Whether that is worth its own permissions and battery use depends on what you install. If everything on the phone comes from Google Play, the built-in protection covers most of it. If you install apps from elsewhere, or handle a lot of files from strangers, extra scanning earns its place.

None of that touches the network. An antivirus app watches traffic only if it installs itself as a VPN to do so, which is a design worth reading the permissions post about before accepting.

What a VPN does, and does not

A VPN takes every packet the phone sends, encrypts it, and delivers it to a server elsewhere, which forwards it on. The Wi-Fi network, the café, the hotel, the campus and the carrier see one encrypted stream to one address. The sites you visit see the server's address rather than yours. What a VPN hides lists exactly who sees what.

A VPN does nothing about content. A malicious app downloaded through the tunnel is delivered intact; the tunnel is not inspecting it, only carrying it. A phishing page loads through a VPN as readily as without one. Malware that is already on the phone talks to its operator through the tunnel like any other app, and a VPN server has no way to tell.

The reason people conflate the two is that both are sold as "security". They are, in the sense that both reduce a real risk. They just reduce different risks.

The public Wi-Fi case

This is where the difference is clearest. On hotel or airport Wi-Fi, the risks are the network itself and the people on it: someone reading unencrypted traffic, a fake hotspot with the same name as the real one, or an operator logging every site you visit. Public Wi-Fi risks and fake hotspots cover the mechanics. Antivirus does nothing about any of it, because nothing malicious is on your phone. A VPN addresses all of it, because your traffic is encrypted before it reaches the network, wherever it goes next.

The reverse case is a file someone sends you that looks like a document and is not. A VPN carries it faithfully. Play Protect or a scanner is what stands in the way.

What you probably need

For a phone that installs only from Google Play: Play Protect, which you already have, plus a VPN for any Wi-Fi you do not control. For a phone that installs apps from elsewhere or handles many files from unknown sources: add a scanner, and keep the VPN for the network. In neither case does one replace the other, and in neither case does either replace strong, unique passwords and a moment's suspicion at a login page you did not expect.

Culvert VPN handles the network half, encrypting every app's traffic and hiding your address from sites while leaving what is on the phone to Android's own protections, and is on Google Play.