In last few years, virus and malware have been rare for me. Firefox blocks most of the tracking scripts and avast do stop any phishing or malware javascripts.

I personally prefer to not upgrade to windows 10/11 and Windows 7 is serving my purpose well, all the software I use/download are either from official website or from github release archives. My documents have scripts and macros disabled by default. I keep eye on every startup items, background processes and any unwanted resource hogging processes.

I tried to switch to linux for this purpose, but I needed to hack many configs and find drivers with updates. So, I went back with windows 7.

Antivirus products these days are not very privacy-aware and most of them upload personal documents to the cloud for 'analysis'. Now and then I run ClamAV on my friend's computers to clean up spyware & trojans, but that's it. Rootkits are a bigger problem though and not so easily removed because of persistence, but they can be removed by doing a clean install or just using a brand new (known clean) VM disk image.

Not necessarily ?(firmware, bios etc...)

[1] - https://www.virustotal.com/gui/home/upload

What about private/sensitive files, do you use them or have another procedure in place?

Yes.

Are they free or they charge when you increase usage?

I believe they do have limits for free usage but I have never hit them. Businesses have paid relationships with them to use their API.

What about private/sensitive files

The only executable files that fit the description would be 0-days that friends created in my prior professional career and those files I knew were malicious by design so I would not submit them unless I wanted to trip up their demonstrations.

For anything that appears to be multimedia but may have come from an untrusted source I will analyze the file myself using open source tools or if in doubt I will just delete the files.

When I was using windows for gaming my mindset was basically to act like my computer was compromised from day 1 and everything I was typing could be read by someone else. Using an antivirus monitoring everything I do or mining behind my back would be like actually making sure I was compromised from day one....

Anything that needs to be a bit secure goes on linux, and I don't use antivirus on linux either. If you don't download garbage and aren't directly targeted by a state actor or world-class hackers you should be fine in most situations on linux, so I don't see the point. And if you are actually targeted by this kind of people an antivirus won't save you. A sandbox and acting smart might.