Use what’s built in. Don’t feed the AV companies and their bloatware, which (conspiracy hat on) potentially is feeding virus writers also 😉
But seriously. MSE / Defender has been the only solution that doesn’t cripple your computer or get in the way of work in the case of a business environment (as a developer, have had many situations where the AV software has broken builds, despite putting exclusions in).
Microsoft’s AV is also perfectly competent at what it does. It isn’t super pro-active in that it isn’t checking all your email or your browsing traffic. It just catches it when it attempts to execute. That’s a good thing because the pro-active options seriously slow your computer down, break software by putting hooks into them that introduce bugs, and are generally just irritating to the user and if the user blindly dismisses pop-ups asking for action then it’s useless.
Commercial products of course may have firewalls also… so does Windows, and it does the job fine without impacting on performance.