Do I need a security plugin for WordPress?

I just had an issue with malware injected into my woocommerce store and I probably wouldn't have caught it if I didn't install a security plugin and ran a scan.

What security plugin are you all using or should I even be using a security plugin?

I found the issue with clean talk security. Clean talk originally didn't catch this until I installed their security plugin.

+1 for WordFence & Cloudflare. Beside that, make sure everything is updated. And, if there are any, get rid of the default wp themes. From time to time, change the salt keys. Lastly, never use dummy credentials. In fact, since your site was already infected, update your old credentials, too.