I'm not a fan of just running Windows Defender and I use Avast with a paid for Glasswire firewall (has built in malware detection). Glasswire does have a free version which I'd also suggest you run.
For a lot of really technology phobic people who might click on a bad URL, I would say running just windows defender is really dangerous.
Someone who has the smarts to not click on that dangerous URL, sure, run just defender.
You should definitely upgrade to windows 10 or 11. That's a far bigger risk to your data than you think.
There are a lot of bad people out there scanning the web for vulnerable computers and since Win 7 is no longer properly supported, you can be attached very easily.