How does antivirus find the files accessed by an application without root access?
It's simple - It doesn't. Antivirus on android has very limited access. It can't check what the given app is doing. It's not very useful. It may warn you if it finds something suspicious on sdcard/externalsdcard or one of your installed apps is in their database marked as bad. It can't scan the app data files, it can't scan the main system, so it's pretty pointless to use it.