The basic tasks of an antivirus do not require that much of super-user accesses; to see whether a given executable file seems to contain a known virus, then read access to that file is sufficient. This can be done from userland, without modifying the kernel or even obtain
root privileges; the system of configurable permissions for apps can handle that. Similarly, interception of network traffic can be done with the relevant permission.
What would require fiddling with the kernel would be launching the antivirus on a file when that file is executed. But Android has a stricter security model than desktop operating systems; application code cannot do everything it wishes, e.g. inspecting the RAM used by other applications. This constraints what an antivirus can do, but also what virus can do. If malware has already gone beyond this system-enforced layer, then things are much worse than what antivirus can fix.
On a rooted device, of course, these things change a lot. A rooted device is much similar to, say, a PC. In that case a PC running a kind of Linux, where both virus and antivirus are scarce.
Apparently, Google is (or was) very much against the mere idea of an antivirus on Android. The permissions model is such that, at least on the paper, malware filtering is better done on the app repository (Google Play); at least so it is claimed. Antivirus software is useful only as long as it detects malware which would otherwise be disruptive for your device or your data, but such disruption would be considered as a bug on either the OS or the app repository, and promptly fixed by Google. Thus, an antivirus is efficient only insofar as the antivirus vendor and its update policy are more reactive than Google themselves.