Well it’s not really safe to use the FP1 anymore because there are no more security updates, but afaik most antivirus apps for android introduce more security risks than they fix. Just stay away from shady things that could be virus-infested (don’t open email attachments from strangers, don’t browse untrustworthy websites and don’t download random apps).
No, If FP2 is stuck on Android 6 official security updates won’t be provided for a very long time anymore, but afaik FP is working on an upgrade to Android 7. Unlike with the FP1 I’d guess they would continue to provide spare parts for the FP2 even if they are not able to officially support it with security updates anymore. It’s very easy to install an alternative OS on the FP2 and get security updates at least for a bit longer. Also I hope they have a bit of a financial cushion now for continued hardware support.
The last official infos (here, here and here) are from May '17 and are not very specific. No news since then.