I don't get it. You use an Anti-Virus software to protect you from threats, a common threat vector is email, so the software scans emails to detect such threats

I don't get it. You use an Anti-Virus software to protect you from threats, a common threat vector is email, so the software scans emails to detect such threats. All consideration of how well that actually works aside, it's doing exactly what you wanted it to do. The software needs elevated privileges to do that, and you granted them. You have given it the keys to the castle and now you complain it's using them to install an extra certificate? That might come as a shocker to you, but all security is compromised if the system ensuring it is. They don't have to install that certificate; they can patch software and APIs all day and it wouldn't show up in any fancy GUI. You don't have to break the crypto or MITM it if you have exclusive control over the software performing it. Nobody tries to break disk encryption; they sneak into your room and replace the TrueCrypt bootloader on your laptop with one that looks the same but phishes the password.