Phone suspicion regarding phone security

hey everyone,

i have this paranoia about my rooted phone that some software can automatically share all my personal files and photos via gmail and whatnot. does any such software exist, and is my suspicion valid?
also, some apps require permission to access "billing services". do these apps automatically start to incur charges? what about malware, that call foreign lands through your dialer? will AVAST antivirus protect me from that? honestly i think AVAST is useless because i tested it with a trojan which it could not detect nor remove...
do my suspicions have any basis, or am i just overthinking things?