Most viruses come from clicking bad links or phishing attacks. I've used windows defender and malwarebytes for over 15 years without a single issue. I also back up physically and to the cloud so if something did happen I could be up and running again easily. At the end of the day I think buying AV is a waste of money. The only thing I would spend money on is a decent firewall with deep packet inspection.
watch out. our client's ransomware attack took out the backup datastore (and veeam is normally one of the best, although it is windows based)
i would say you are fairly safe because you are careful. MANY PEOPLE would click a link if it said "click here so we can crash your computer"
we encourage our clients to subscribe to KnowB4 or a similar service which gives you 30 minute tutorials, followed by a test, with monthly updates so you should be able to spot the latest, most likely threats. it also sends harmless phony threats to see which employees can pass the test, but not recognize the threat in the real world
the larger your staff, the more likely to have at least one careless idiot or someone who doesn't take the risk seriously. our largest client hovers around 135-160 employees, depending on the time of year. remember the worst part is, you can have 20 people filling in for vacation, jury duty, maternity leave, which means 15% of your work force has never seen what normal email flow is for a new department.
people with 5 employees just don't recognize the difficulties of a larger company