A non answer / misdirection here may be to not go for tacking on malware detection to an already malware prone / hostile operating system, and rather start in a

A non answer / misdirection here may be to not go for tacking on malware detection to an already malware prone / hostile operating system, and rather start in a better position by using something like grapheneos. Having more control over what happens on the system is important to get malware in the first place. I imagine even more secure OSes will be coming out soon based on Rust, etc but the last time I checked GrapheneOS was a decent choice.