Just to close the loop on this, I found the syntax I was looking for. I was missing the {websecurity} profile, so now, when I create a VIP from tmos, I use the syntax below, and can add the ASM DOS profile and policy successfully:
`create virtual VIPNAME_virt {destination VIPIP:PORT mask 255.255.255.255 snat automap profiles add {Analytics_profile} profiles add {OneConnect_profile} profiles add {VIPSSL_profile {context clientside}} profiles add {WanOptimized-HTTP_profile} profiles add {WanOptimized-HTTP_profile-compression} profiles add {LANOptimized-TCP_profile {context serverside}} profiles add {WANOptimized-TCP_profile {context clientside}} profiles add {WanOptimized-HTTP_profile-cache} persist replace-all-with {Cookie_profile} profiles add { websecurity } profiles add { HTTPClass_Profile--profile-dos} policies add { HTTPClass_Profile } pool VIPNAME_pool}`