The latest version of Sophos is 9.4 although right now they are in the middle of switching users from 9.2.8 to 9.4 and some Macs will not have made the switch as yet.
If items are listed in Quarantine then those are 'completed'. It is then up to you to chose whether to authorise them i.e. if you think they are not malware, or to tell Sophos to 'clean them up' if you think they are. In general cleaning them up means it will delete them.
You could then run a scan after this to see if it finds any more.
Sophos gets good scores in comparison reviews and my own experience is that it is pretty good, certainly compared to ugh! McAfee and Symantec.
There is increasing amounts of Mac malware and while the effectiveness of (Mac) anti-virus products maybe arguable it is also good manners to prevent sending Windows malware to people even if it would not affect your own Mac. If your a business it is almost compulsory so as to avoid accidentally passing malware to clients and risking loosing the customer.
PS. The thing with Sophos that most annoys me is that it will spot malware in a Time Machine backup, however it cannot clean the Time Machine backup up, and it also it seems cannot be configured to ignore the Time Machine backup. As a result you will effectively continuously get nag messages about 'quarantined' files which are actually in the Time Machine backup which you can do nothing about. 😠 The reason malware gets into the Time Machine backup is that typically you get an email with a malware attachment, this is initially a 'new' variety not recognised by Sophos, it gets backed up by Time Machine, and then later after a virus definition update Sophos learns it is malware and starts triggering these annoying messages. Each time Time Machine thereafter does a backup it compares to the existing backup which triggers a file access which triggers Sophos. 😠