to explain it in details
- if turn off all shields then there is no real-time protection for your Mac, only the on-demand scan == you have to run it.
- if you turn off only web shield then your network traffic isn’t scanned however there is still running file shield. And when an file hits your harddrive(on write, on open) then file shield scans it. And if it’s malware then it’s moved to the chest
It’s up to you what level of protection you choose. AV defaults are shields “enabled”.
However your original question was about “has the AV to be open and icon present in tray?”. Answer is no. However the shields have to be running(Enabled) to provide real time protection.