Actually I don't think they could. A-V products inevitably insist on running with very high privileges on target machines, restricting the OS' ability to mitig

Actually I don't think they could. A-V products inevitably insist on running with very high privileges on target machines, restricting the OS' ability to mitigate any vulnerabilities. A-V products also have been shown be research from Google Project Zero to be doing very dangerous things (like running a local web server you can send commands to that are executed on the device). When you combine high-privileged code with dangerous practices you get a very nasty set of risks that aren't present with most other software. As there is an alternative that doesn't have similar problems (MS Defender) it seems sensible to recommend it.