Apple designs iOS so apps can't get at each other's data. Every third-party app runs in a sandbox that, in Apple's words, is "designed to prevent apps from gathering or modifying information stored by other apps." That's why no iPhone app can scan your other apps for viruses the way antivirus does on Windows or Android. TotalAV's help center puts it plainly: its iOS app does not run an antivirus.
Apps also reach you through a reviewed channel. Apple says it reviews every App Store app and update for privacy, security and safety, with automated scans for known malware, and a baseline notarization review applies to all iOS apps, including those distributed outside the App Store, which is allowed in the EU, Japan and Brazil.
Several scam filters are built in. Safari's Fraudulent Website Warning (Settings > Apps > Safari) warns you when you visit a fraudulent website. In the current iOS, Messages can screen texts from unknown senders and filter spam, and the Phone app's Call Screening can ask an unknown caller for their name and reason for calling before your iPhone rings. The Passwords app flags saved passwords that have appeared in known data leaks.
Updates matter more than any app. Check for them in Settings > General > Software Update and turn on Automatic Updates; Background Security Improvements, in Settings > Privacy & Security, add protection between software updates. Stolen Device Protection requires Face ID or Touch ID for critical changes, with no passcode fallback, and Lockdown Mode is an optional, extreme protection for people who may be targeted by sophisticated attacks such as mercenary spyware.
So for many iPhone owners the honest answer is no: keep iOS updated, leave Safari's warning on and use the built-in filters. A security app earns its place in the gaps: scam texts and calls that get past Apple's filters, risky links opened outside Safari, public Wi-Fi you'd rather route through a VPN, breach alerts that go beyond your saved passwords, and one subscription that also covers the household's computers and Android phones.