I used to have it on my Raspberry Pi to test some shady files. Besides of the Linux thing, they'd also need to get around the fact I was running things on AArch64, which is a rare combination. Maybe Windows on AArch64 would have been an even safer choice.

That's partially my point. You can never be 100% safe, but there's a lot you can do to increase your safety besides just relying on intuition (edit: because intuition is usually the weakest link, see social engineering/phishing tactics). Anti viruses (when they aren't just bloatware) are part of that.

Your second point about not meaningfully defending against backdoors and vulnerabilities is kind of against the point. You can totally defend against backdoors by not giving apps admin privileges, limiting network access, etc. so that damage can be limited even if an exploit happens. Then, if some backdoor or exploit is discovered, it's only as dangerous as the permissions you give that app.