stinkingbroom I installed the TOR browser update via fdroid, which gets it directly from TOR. That installation was then scanned on my phone by Bitdefender and Avira, each of which are good on Android detections, and each reported no issues. My guess is that Microsoft defender gets signatures from TrendMicro (and possibly others), and that either TrendMicro is very prescient on Zero-Days or that this is a false positive reported on by Virustotals and therefor on your Windows computer. FWIW I suspect the latter.
P.S. Aurora notes an Exodus report that the Tor Browser is "infected" with: Adjust, Mozilla telemetry, and Google Firebase Analytics. You may want to consider Vanadium/Orbot which won't have those little minders, but may have unique browser fingerprints at the destination - Heh....pick your poison based upon your threat model. There are threads here on this tradeoff.