I used to think it was pointless to have an anti-virus on a phone also. Yet at my last tech job we occasionally had people bringing in Android phones and tablets that were infected. I saw ransomware(full screen splash demanding money), xxx shortcuts that you couldn't delete(or would re-appear after deleting), re-directs on the browser that would still be there after resetting the browser, etc... Saw some where the screen kept doing this "refresh effect" and you wouldn't be able to open anything. The worst ones were where the recovery image had been corrupted.
Even now I think "what the hell did these people do/look at?".. I have yet to have something like that happen to my phone.