100% agreement with KiltedTim. Get rid of Sophos and the so-called IT expert.
You are exposed to nothing. Or more specifically, nothing different than with, or without Sophos.
There are no Mac viruses. None. Haven't been since the release of OS X, 10.0 in 2001. A virus is self replicating malware that is virtually impossible to run in a Unix structured OS. Permissions are just one thing that prevent it.
Can your Mac get infected by anything? Yes, that type of malware is a Trojan or worm. Or, software that requires YOU to be the one to install it. It can't self replicate and it can't get on your computer on its own.
If you install any type of Trojan or worm, AV software will not lift a finger to stop it since it can't know what you're installing or running until after the fact. Often, they won't even tell you you've just installed malware. We've seen many such topics here where the user had up to four AV software titles running, and their Macs were still loaded down with adware or worse. That's how useless AV software is.
Avoiding malware is really this simple:
- Never, ever download or install anything from P2P, file sharing or pirate sites.
- Get your third party software only directly from the vendor who created it. If it's cost software, pay for it. Do not go the route of point 1. to try and get it for "free". That's a sure way to install much worse malware, like key loggers or back doors.
- Pay attention. Read up on new, actual threats as they're discovered so you know how to avoid them. So far, they have all either been Trojans, or direct attacks where someone else with access to your Mac gains deliberately infects it.
- Ignore the hype on the Internet of the many, many supposed security sites shouting "Mac viruses!!!!" I have yet to see one that screams they have a list of Mac viruses, and every single one is a Trojan.
Also, as has been noted, Catalina made it extremely difficult for malware to be installed since the System folder is read only. Big Sur ramps up that protection by a factor of 10. As a Signed System Volume (similar to iOS), it's now virtually impossible for anything to write, delete or modify any part of the OS other than Apple's own updates.