I agree with what you're saying, but it's worth noting that the kinds of attacks you're talking about cannot be reliably stopped by anti-virus. Instead, they'r

I agree with what you're saying, but it's worth noting that the kinds of attacks you're talking about cannot be reliably stopped by anti-virus. Instead, they're stopped by almost constant security training. And, I'd argue that if your security training is good enough to get people to recognize phishing, spearphishing and the ilk, it's good enough to get them to recognize the kinds of low hanging fruit that reactive anti-virus software protects against.