The trouble with av is that it runs on file access so slows down any pc it runs on. Add in the bloat you get with most software and you'll see a noticeable performance degradation.
You could run clam av on a schedule? I think that mostly searches for Windows threats stored in Linux though.
Most Web servers are Linux, and they would probably just run clam av I'd think.
Most important aspects are fully updated OS, good browser, good browsing habits, not installing from websites.
The most common infection vector is an infected website installing malware. It's hard to imagine that working on Linux as you would need root prevelidges to install, and each malware would only work for one distro.
Malware is a numbers game, as to install enough to make money you have expose lots of machines, then infect a percentage of them. If you focus on Linux it's going to be a very small number that get infected, if any at all.
Go for Windows or Mac and it's easy. Many people have no av or its out of date, out of date OS and browsers, no password, running as admin, willing to trust sudden "your pc is infected pop ups", much easier to scam.
Interesting discussion here, although it's mostly about servers.
Does linux servers gets affected with ransomware
