From what I gather, because of the way WP handles apps... It would be very hard to make a virus that would infect apps. I'm not saying it's impossible, but I have never heard of one so far.
Applications have very limited access to the resources of the phone, and run in a confined space.
And if there is no virus, no anti-virus software on demand and, here and there of.