My antivirus for Linux is a policy of not executing things as root and installing things via safe channels when possible.

If I’m setting up a server or other untrusted service, I create a user specifically for it that has very limited permissions.

This makes it so that when something is compromised it is still trapped in a box and can’t spread.