Mac only gets infected if something is installed?

No system is invulnerable. No system.

But as a rule of thumb, the best virus protection is the squishy thing using the computer. Avoid plugins like Java and Flash, don't gleefully search for women's boobies at every opportunity, and be vigilant when browsing the Internet or opening/running files.

However you are right. With very few exceptions, there are limited points of infection on a Mac, all which require the user running an application. The belly of the system is locked down with SIP and you can't run root commands even as an admin. Though there have been examples of this happening, such as in hacker tournaments or articles about hypothetical exploits, there hasn't been a single case of a self-replicating virus in OS X's history.

Now, that's not to say that you should be lethargic. But it's also worth mentioning that plenty of people who use Windows without any virus protection at all never have an issue either. So there's a lot to do with the user. Based on what you've said your usage is, I wouldn't be concerned.

And finally, almost any infections you'll encounter on a Mac can be immediately cleaned with a quick blast of MalwareBytes for Mac. They're not particularly malicious or clever and struggle to really do any damage; namely due to a combination of security (much more locked down than Windows) and obscurity (much less marketshare than Windows, so less people target it).

Sorry for the lengthy reply. Hope this helps!

 

That's correct. If any application wants to make a system change, even so much as moving a file to a folder, it'll ask you for your user password and list the application that's trying to run.

It's similar to Windows' UAC, though a far more elegant solution than Microsoft's — it won't prompt you for user permission whenever you exhale at your monitor.

 

One thing.... Beware of MacKeeper. God I hate that effing program.

My son downloaded something on my MBP and next time I opened it up I noticed that POS hanging out on my system.

 

1) Is it true that only threats to Mac are things user installs?

NO, there are multiple avenues of attack and threat for all operating systems. The biggest vulnerability is the user but there are vulnerabilities in every OS.

http://www.cvedetails.com/top-50-products.php?year=0

I use Symantec endpoint protection on my Macs and MS systems. Since I share files and multimedia in my home network I don't want to download something that does not affect one OS but might destroy or give remote privileges on another.