Incompetence reins there. A few years ago I was working on an MSI deployment for something and Defender decided to think it was a virus. Turned out it was an MSFT DLL that we included with it that was tripping it. Took a whole month for them to sort it out.