Windows Free AVs are usually fine until they get bloat/ad spammy.
I've worked my way through most of them because of this, eventually they all get annoying unless you start paying. Something like:
AVG -> Avira -> Trend -> McAffee -> Avast -> ClamAV -> BitDefender and now Panda.
I've also used Sophos/Norton etc in a professional capacity but this is a very different use case.
Windows defender is fine for the most part these days, I'd go so far as to say quite good even, unless you're actively trawling the dark web looking for cracks and such. But for zero cost, there's also no reason not to go for something else if it's better. The main value add from paid AV packages is usually the extra stuff they bundle in like family controls/VPN/peace of mind etc. and for this mileage varies.
Almost all firewall apps in windows are unspectacular, bordering on snakeoil and essentially just front ends for windows firewall. Also on a home network you're behind an SPI firewall on your router and probably some degree of protection from your ISP anyway. Essentially, if your machine got 'hacked', there's a high chance you clicked something that allowed it in to begin with (which no packet filter will prevent as it just appears to be regular traffic). People's opinions differ on this from a 'is it fair' perspective, but seriously why everyone should employ some form of ad-blocker extension in their browser of choice, and if you can tolerate it NoScript.
Again different when you look at it professionally, but at that point your firewall is a physical device and you're probably running an IDS.
I still use TinyWall on my personal devices because old habits die hard, but means I have to enable any new service to access the internet which is always manual (as it should be)
At the end of the day, spend money on a ransomware-aware backup solution (i.e not a second/external HDD, something on a physically separate device) before an AV solution. They're called 'zero day exploits' for a reason.
