If your phone doesn’t yet have Play Protect, don’t think that your phone is left insecure — but once it does, it’s worth poking around in the (admittedly simple) settings to see what it’s all about. But the most important thing you can do is just keep that “scan device for security threats” toggle turned on. Google can’t catch every malicious app, but it has historically done a pretty great job and now users have a better feeling for what’s happening with app security on their devices.