why root accounts aren't available on Android phones from the beginning?
Standard android apps are subject to Android permission system, which requires apps to declare the permission they require in a Manifest file. An app that have root access can easily circumvent around this permission system.
Being derived from Linux, why isn't it like on Linux with the root account and other accounts?
It is just like Linux. Even in desktop Linux distros, notably Ubuntu, the standard root account is disabled by inaccessible password.
I am thinking maybe malware protection, but there are malicious software that can do harm without root account right?
Yes, for example, there are malware apps that can send your contact lists to a shady server in a third world country. In a phone without root, these malicious apps will have to declare the permission to read your contact database in the Manifest, which is read and displayed before installing an app, giving you the chance to cancel installation. In rooted phones, it is possible for an app to read your contact database without explicitly declaring it in the Manifest, by asking for root permission instead. There are many other potential security breaches that can simply be avoided or minimized by disabling root access.
Also, in some systems, root can modify system files; modifying system files can make it impossible to completely revert to factory default (because those modifications would persist after the revert). Without root, one would have to use the bootloader to flash system file; greatly reducing the risk of malicious apps installing itself in a way that will persist over a factory reset.
Shipping phones without root also reduces the cost of customer support, as the number of ways that a customer may shoot him/herself in the foot are greatly reduced.
"With great power comes great responsibility", The sudo Lecture, also Ben Parker.