I solved the security side of things by locking down the system and giving her access to a non-admin account.
I removed access to IE and Edge, added Firefox with uBlock and Bitwarden, and removed the ability to add/remove add-ons.
I added ClamAV to scan Outlook attachments and scheduled weekly scans just in case.
No complaints or security incidents for about a year now.
I documented the process of doing this here https://noteaureus.org/post/tutorials/sysadmin/win4unsavvy/
Now the majority of people (myself included) simply use Defender and ensure its upto date.
The other is malware for consumer machines. Every behavior of third party anti-virus/malware software for consumers is indistinguishable from viruses and malware...including holding machines hostage for cash payments.
[1] The current version.
The days of Norton and others have long been over from my POV.
The typical setup is:
Gmail web interface for e-mail
Windows with the default defender install
Malware filter on DNS level (nextdns, Adguard or even through ISP)
Nothing bad happened in the last couple of years.