Well of course it has no anti-malware features, the only protection it has is that no credentials are sent to the client, just an authorization token, which you can disable using your phone.