Protection looks through the site files for known malware traces. Some plans also check whether the name has landed on a blocklist. A clean report does not mean a plugin hole will not appear tomorrow.
A scan does not strengthen your password and it does not replace a backup. Keeping plugins current is a separate job. The cards are on the security page.