Vulnerabilities aren't the same as viruses/malware.
A vulnerability is a flaw in the operating system or a legitimate program that allows unexpected, unauthorized, and unwanted control of the computer.
Common types of vulnerabilities are:
- execute code: Flaw in program/OS allows attacker to run arbitrary code, programs, or instructions.
- elevation of privileges: Attacker (or attacker's program) finds a way to run with higher privileges (usually as admin or root) than it should have
- unauthenticated access: Attacker gains authenticated access to computer with no valid login
Some vulnerabilities can be combined/chained together for massive damage. For example, if a computer had all 3 of those vulnerabilities, an attacker could potentially gain authenticated access with no valid login, elevate privileges to root, then wipe or rig all system files.
Rules of thumb to avoid exploits and vulnerabilities:
- Keep the operating system patched and up-to-date.
- Keep your firewall up at all times; block incoming connections and only open ports when needed (close them when finished)
- If you are running programs that need to accept incoming connections (such as a server program), keep them patched and up-to-date.
- Disable/uninstall known vulnerable programs where no patch exists to fix them.
- Use a regular (non-admin) user account; have a separate admin account for admin tasks only.
Antimalware/antivirus is a different type of protection entirely. Malware and viruses are programs/parts of programs, and antimalware/antivirus specifically scans for those and attempts to block them from running or remove them entirely. Antimalware might stop malicious code execution via an "execute code" vulnerability - only if the code was flagged as malicious. On the other hand, if the malicious code looks legitimate (such as "Delete all files in this directory") then the antimalware wouldn't block it.
While Mac OS definitely has better built-in protection against viruses and malware, there's no foolproof OS - particularly when so many users are willing to give any downloaded program admin privileges on install.
Most of those articles claiming that Mac OS doesn't need antimalware or antivirus are an artifact from the old days when Macs were much more uncommon (malware usually targets the largest amount of computers for the minimal amount of effort). After 2013, Macs became much more popular (probably related to Windows 8/8.1/10) and a bigger target for malware.