If an OS needs antivirus for this, that OS has been designed wrong (excluding Linux, FreeBSD etc as the target audience isn't regular end users) in the first place.
An OS should NOT need antivirus, it needs proper sandbox and containerization.
An OS should NOT need antivirus, it needs proper sandbox and containerization.
- an app can 100% stay within its sandbox and still be nefarious. For example, a password manager could secretly send all your passwords to Mr(s) Evil.
Also, the possibilities for nefarious apps that aren't thwarted by sandboxes are endless: social engineering and phishing are very common and effective.
These are good to have, just like how it's good to have an antivirus. In some cases.
Most of the people download things which were checked before with an antivirus (like Play Store, App Store, GMail), or they don't really download anything outside of browsers (e.g. on desktop), so most of the people (almost everybody in case of percentage) don't need that much protection than 20 years ago. I also don't need neither OS level sandboxing, containerization, nor antivirus by default, because I know how to prevent compromise even without those. I, of course, use those when they are needed, when for example I install or browse something risky. But then I use a full blown VM, or an ultra sandboxed browser, and I know the risk, that there is nothing I can really do, if they use a vulnerability of my hardware for example.