The point of AV is to catch that PCI DSS stamp of approval, not catch malware. Regulatory capture is the best marketing strategy