This is ironically one of the ways using any AV can increase the attack surface of a device, leading to its compromise. I don't know if ClamAV has ever had an i

This is ironically one of the ways using any AV can increase the attack surface of a device, leading to its compromise. I don't know if ClamAV has ever had an issue, but it seems lots of people here have forgotten the zoo of not-that-long-ago Windows Defender exploits that could be triggered by it scanning various files, like in a spam email the user never even looked at but their client downloaded a copy of anyway. The issues are often made worse by the AV processes that get owned already having root privileges.