You don’t need the two "y"s. That wastes mirror bandwidth.
Use yay -Syu or just yay.
That being said, updating won’t install firewalld if you didn’t have it already. You probably have it because your install is recent.
It is a hard question to answer. The concept of “enough” as it relates to security depends very much on your personal use cases, risk tolerance and other factors.
Having a firewall is a good start though. You still need to practice generally safe habits when using the internet.
I don’t personally run any kind of anti-malware although many people do. I behave pretty cautiously though. Anti-malware is a strangely controversial topic for Linux users.