He's not wrong, most traditional AV is complete hacked-up shit. Some of the "Next-Generation" AV(I think they are trying to rebrand this as Endpoint IPS too) like Cylance, CrowdStrike, Webroot are better in that they do a lot less crap on the endpoints to begin with, so there is less to screw up.