There is some good points here.....
Yes, cruising the internet there would generally need to be a malicious program specifically written to take advantage of the situation in order to infect your system, but this is also an application we're talking about, not a Windows OS PC...
For Example:
A typical malicious program waiting for unsuspecting web surfers to travel to it's website so it can infect the computer (you can get a virus just from visiting a website-even if you don't click anything) sees let's say a mac and let's it go by, sees an android tablet device & let's it go by, but then along comes a dell running windows xp and it infects it...this happens because that malicious program has the ability to infect a machine using window operating system....probably written that way because more windows PC's are cruising the web......so what if it's written for the ever popular daily growing android OS?
Well what should happen is when it goes to infect when you visit the website the Droid says "no thanks pal" because you don't have the box checked to allow the installation of unknown sources because you're a responsible rooted droid owner and made sure when you were finished downloading that .apk you went back into settings and unchecked that block....
So what if you didn't and you don't have a snazzy AV app?? Well you should visit the website and leave without getting infected, many reasons why, but the top 3 for me are:
1) Your task bar let's you know when something has been downloaded or installed or when a download or installation has failed which would show you exactly what the stowaway was and then you simply go into root explorer and delete it.
2)Apps typically don't run unless you tell them to or if they do auto start after a task killer closed them you can easily detect that within settings>applications>running services-again the stowaway is caught & deleted
3)Most apps mainly run when you use them and don't have interaction with the rest of the system so actually getting an application to maliciously send crucial data to your phone-perform as a carrier for spamming others-or as a key logger would be so hard to do that anyone with that kind of capability either works for google or makes too much money to worry about stealing random personal info...
*Also as an addition to this, the worst of what you'd encounter on your mobile would probably be a key logger (saves and transmits everything you type) so people could steal your bank info if you do mobile banking etc, passwords to e-mail etc etc & an anti-virus especially symantec will NOT prevent the installation of a key logger because other programs use the same technology and AV can't distinguish between the good ones & bad ones so it skips them unless it's been specifically reported to the AV company as a malicious key logger which is easy to change the name....popular programs that use key loggers are MS word, anything like word & any program that auto corrects to include swype.