1. Why does the anti-virus tells you to root your device if it is a security risk
Basically, as answered here, rooting allows you to give root permissions (let's say to execute sudo) to some applications. The list of these applications with root permissions could be controlled with 'Superuser' app (integrated in the Settings for Cyanogenmod).
Also, you (a phone owner) now have root privileges. So if you will start installing software from third-party forums, noname markets/stores and will give root permissions to all of this applications, this will be bad, because you should not trust these apps. If you want to give a rooted phone to your grandma, and she does not undestand concepts of rooting/apps/app stores/permissions/etc - do not do it.
Next, if you are still careful, and only gives root permissions to 1-2 applications you and other people trust (like firewall or file manager, downloaded from reputable source), then it's ok. However, if this file manager or other software has vulnerability, some malware could use this vulnerability to get root access through this file manager, which now has root permissions. That is what I see as a risk.
However, unrooted devices could also have vulnerabilities like Stagefright, that allow an attacker to get root access to the phone, since unrooted Andriod still has libraries / system apps running with root permissions. So all you do is an increasing number of potentialy vulnerable apps with root permissions, that could be hacked (if you carefully select what and from where you install).
Most antivirus apps very often really need root permissions to be able to actively manage/block other apps, if they find some suspicious activity in them.
2. Does firewalls for android devices really worth it
It depends on what do you want from the firewall. E.g., I'm concerned about my privacy. And I still want to use some apps. However, these apps sometimes require Internet access, even though their functionality has nothing to do with Internet communication in my eyes (e.g., I do not want a music player to access an Internet, but I still want to use this music player, while PrivacyGuard has no functionality to control Internet access for apps). So I installed an AFWall+ to control which applications have Internet access. For me, it is worth it. I have a Cyanogenmod with root on my phone.
However, I do not have an antivirus. Personally, I do not see a much sense in having it, since I try to install apps only from trusted sources, see also this question
So, if you only give root permissions only to the single firewall from PlayStore, and you believe that this firewall has no serious vulnerabilities, then "A rooted Android device with a firewall" is more secure.