With a PaaS, they manage both the hardware and software for you (which is different from IaaS, when they manage the hardware and you control the software). The advantage of PaaS is of course that you have less to do - you hand them your application and they manage everything to make it run - hardware, OS, load balancing, automatic scaling, etc... Many of these items can be a pain to manage properly, so PaaS has some helpful advantages.
I know you already know all of this, but your answer is hiding in there. They manage everything, and as a result you implicitly assume that they are managing it properly. Downtime, for any reason, is covered by your service agreement. As a result:
- If they are down because some critical hardware fails, they may owe you a refund
- If they are down because they upgrade their software and crash their systems, they may owe you a refund
- If they are down because ransomware takes over their systems, they may owe you a refund
- If they are down because a virus takes over their infrastructure, they may owe you a refund
- If they get hacked and the attacker walks away with your confidential information, you may be able to sue them for lots of money
So to recap:
Should they use an anti-virus?
Who knows! If they are running an OS that requires an antivirus, then they probably should be. If they are running something else, then they probably shouldn't. Neither you nor I really "know" what their hardware/network/OS setup look like, so no one can answer that question for you. The only question that really matters is:
Can they reliably provide the service they promised and keep your data safe too?
Answering that question goes far beyond the usage of anti-virus software, and is even more impossible to answer. Therefore, the question you really want answered is to some extent unanswerable. At least, I wouldn't expect them to talk extensively about antivirus usage or any details like that. I would just expect them to make general promises about how awesome and secure they are, and probably mention as many positive reviews or referrals as they can squeeze out of their customers. I don't expect your typical PaaS provider to let you "peek under the hood", so to speak, so at the end of the day it is really just about trust and the threat of legal action if they screw up.
Trusting a PaaS
Finally I think it's worth a brief aside to say that while you can't necessarily verify just how well a particular PaaS might secure their ecosystem, it's certainly worthwhile to ask whether a particular vendor might be trustworthy. The problem is that egregious failures on the part of PaaS vendors have definitely happened. The biggest example that comes to mind is Code Spaces. Part of their services were data protection, for which they promised:
“Backing up data is one thing, but it is meaningless without a
recovery plan, not only that a recovery plan – and one that is
well-practiced and proven to work time and time again,” a cached
version of their website reads. “Code Spaces has a full recovery plan
that has been proven to work and is, in fact, practiced.”
Unfortunately they were hacked and had their full infrastructure destroyed by the attacker, effectively destroying all customer data and rendering them immediately out of business. Some caution is required!