Windows is the most secure OS out there, contrary to popular beliefs.
If the only question you're asking is whether an attacker can gain remote access to (or control over) your Windows computer
purely by technical means, then yes, Windows is secure. By that measure, almost every OS is pretty secure these days (OSX being the notable exception).
However, that question willingly ignores 80% of the attack vectors, particularly those that are most common. The biggest security risk is
not the OS itself, but the user sitting in front of it, and these days the OS is also expected to help humans avoid ignorant mistakes. Windows has a really hard time doing that however, because it was developed at a time when such was considered unnecessary. Changing that now, after the fact, would break compatibility with pretty much everything. If you consider ALL the possibilities, Windows is rather poor in the security department. Android is conceptually similar, but as with Windows RT, it gains its malware resistance primarily by restricting users ability to install arbitrary software, and providing only one controlled channel (the app store) through which that is possible.
No system built by humans is perfect, and somebody will eventually find a bug that they can exploit, but still, WP is no doubt the most secure consumer OS ever built, thanks primarily to MS general expertise in that field and WP's security model that is designed to help WP users to not harm themselves. That has required us to tolerate some restrictions (the app store is also just an added restriction), but the situation continues to improve as MS addresses related issues, one by one, without sacrificing WP's security model.
While it's obviously possible for a virus to appear in Windows Phone sometime in the future, I would doubt it. Primarily because the operating system with the most users is the main focus for those who make viruses, and Windows Phone has less than 5% marketshare.
While also true, it's a rather superficial answer to a much more involved issue that can be much more interesting, if you are willing to do more than just scratch the surface.
I want a Virus scanner like Avast included in the store. Why should I trust it when a company says that WP is immune for viruses? Every digital device can get infected with a virus.
Because the individual parts of the OS and apps are strictly isolated from each other. No WP program can "see" anything outside of its own little restricted space. This ensures that even if malware does get onto your WP device, the only thing it could corrupt is itself. For the same reasons, it is impossible for a virus scanner to scan anything except itself, which makes little sense.
Although not 100% accurate, you might imagine that we're all already using virus scanners, it's just that they run on Google's, Apple's or MS' servers, instead of directly on our own devices.