Clamav is ok to use for scanning files for malware. If you want something to detect behavior you can use Falco or tetragon to log events on your system. Those systems are best used if you send them to centralized log system but that’s complete overkill for personal use

It’s gotten significantly better with containerization technologies like oci containers and flatpak. Yes it uses more storage, but the drive space pretty cheap

There are philosophical and technical reasons to not like snaps

Technical

• Slow startup time
• Makes lsblk look really ugly
• For awhile users didn’t have a lot of control over when things updated
• Not designed to work with third party repos by default
• Requires apparmor so it doesn’t work well on selinux distros.

Philosophical

• Backend is proprietary and controller by a single company
• Has made the same amount of effort as flatpak to work on distros that aren’t Ubuntu
• Some people just don’t like Ubuntu