It is a misconception that a firewall completely secures the website. Firewall does provide a good security but it is still possible to inject malware disguised in the form of PDFs, links, documents, etc which look completely legit. A malware scanner informs you of any malware present in your website which might have dodged the firewall and overall increases the website security.