ClamAV

The signature-based antivirus daemon baked into every image. The signature database is packed into the image at build time (/var/lib/clamav/); freshclam is disabled at first boot — new signatures arrive in the next image rev or via user opt-in. On RAM-constrained targets (Pi 4 4GB) clamd is replaced by on-demand clamscan. See Security → Default-on controls.