Some might think it is joke, but it is dead serious:
https://googleprojectzero.blogspot.com/2016/06/how-to-compro...
Unfortunately running an anti-virus is an overly broad requirement in some industries to pass certifications and audits. It's one of the cases where "security" mandates and requirements leads to insecurity.