Your phone is considered quite old, even if it's only 4 years old. I'm surprised you got an update this year since most carriers/OEMs only update their phones for 2 years at the most.
Having an older phone does put you more at risk because of the lack of updates. It's a merry go round the carriers and manufacturers like you on, where you update every 2 years or so because they're not making any money off you on your phone at this point unless you upgrade. As far as anti-virus for phones, it really doesn't do that much because the OS keeps all the apps away from each other - unlike a computer, where an AV product can run at a very low level and see everything, on a phone the AV app has no special permission to allow it to do anything.
Apps need access to the SD card to store data. Depending on the app this may or may not make sense. Think of a photo editing app - it certainly needs to be able to see your pictures (read access) and be able to make changes to them (write access). Other apps, like a flashlight, for example, has no need at all to access your SD card in this manner. Depending on the version of Android you have, you might be able to grant each permission separately, or it might be all all-or-nothing situation if your OS is older than Android 6.