Also from a practical perspective, its very rare to see an AV compromised If by very rare, you mean, constantly, then yes. You're hearing less about this becau

Also from a practical perspective, its very rare to see an AV compromised If by very rare, you mean, constantly, then yes. You're hearing less about this because the AV industry is fragmented, so targeting AVs is not interesting because you only reach a small percentage of people. There's less browsers and the biggest ones reach literally multiple tens of percents of internet users, which is much more interesting. but we're constantly seeing browsers, plugins, etc compromised. Heck, Firefox just had a zero-day yesterday. ...and it was protected by its sandbox from infecting the system. (The actual exploit was a privacy unmask targeted at an older version) The same sandbox that can't be tightened due to AV. See the problem? How many AVs were blocking the exploit faster than the browser vendor released an update, anyway?