In my opinion there's very little reason to use paid antivirus/antimalware software these days. While it was true that years ago, Windows Defender was a joke and the use of third-party antivirus was warranted, to their credit Microsoft did invest a lot of time and money improving Defender and adding all kinds of nice security features into Windows 10 and Windows 11 (some are not enabled by default, but are actually quite nice to use). With that, Windows Defender caught up and in some cases surpasses a lot of paid AV suites when you read the third-party AV test data, and it's free! The days of needing to pay for antivirus/antimalware protection are long over and have been since at least Windows 10's release. And honestly I would recommend to people with actually AV subscriptions to use their AV of choice until the subscription runs out and then get rid of the AV and give Windows Defender a go. Who knows, it may save you some money, and who doesn't like doing that?
I've seen instances where antivirus suites actually
decrease security, for example a couple years ago when TLS 1.3 first came out some AV apps with Web (or HTTPS) protection didn't support it for a good while as a lot of popular sites were adding support for it and would force those websites to fallback to TLS 1.2, TLS 1.1 or worst of all TLS 1.0. They also tend to install their own root certificate and use that in web browsers to monitor traffic (which is known as man-in-the-middle) which even though it can be potentially helpful is for all intents a security issue. HTTP/2 is a thing now and I'm not sure which AV suites have been updated to support that.
And no, Windows Defender not any other antivirus/antimalware app is perfect. All of them will either miss things or cause false positive detections at one point or another (or many times, I'm looking at you AVG). First and foremost, the best protection is common sense; not opening links in emails that aren't from verified trusted sources (and even then it's good to be cautious), don't visit shady sites, never post information publicly on social media that could potentially be used in a social engineering attack. If you're technically savvy, using features like Windows Sandbox or virtual machines via Hyper-V or apps like VMware/VirtualBox to do all your web surfing in can also add an additional layer of protection... and yes, it adds more attack vectors too. Can't really win, huh?