The issue is that you must check the external connection, i.e. <-2-> in: User <-1-> antivirus <-2-> Site If not a hostile actor can inject themselves in a w

The issue is that you must check the external connection, i.e. <-2-> in: User <-1-> antivirus <-2-> Site If not a hostile actor can inject themselves in a way which is completely invisible to the user: User <-1-> antivirus <-2-> Hostile <-3-> Site Actually checking <-2-> is tricky but many antivirus tools don't even try.[1] [1] https://news.ycombinator.com/item?id=10727431 https://news.ycombinator.com/item?id=10727431