I keep seeing this point of view around IT communities, and I think it shows how out of touch most people are with the average user capabilities, or just being pedantic.

AV software isn't there to prevent ingenious hackers to take control of random computers. Yes, it actually might create more surface for that purpose.

It exists because most users do not have any understanding of the platform, and will just click on "accept", "yes" and "ok" hoping things will turn out well. AV are pretty decent at mitigating that. At the cost of some performance loss, you'll avoid having a bunch of ads and popups take over your computer, or at least mitigate the phenomenon.

But for such a user the choice is not third-party AV or nothing - Windows comes with AV software - so the true benefit of an AV product is only in how much better it is than the integrated one. That difference needs to be more significant than the product's drawbacks AND price.

Without knowing the rates of use of each kind of malware it would be hard to tell. Since the issues in AVs were published by Zero, rather than found in the wild, there's a good chance they were not known, or used only for specific targets.

AVs are still useful for "we're employing 1000s of people, some of them are bound to open that bad word document in the email". Useless for targeted attacks, but useful for worms with signatures known for weeks. If you can't deal with the issue in some other way, AVs still give you something.

Anything that's been known for weeks can be stopped at the point of ingress such as the email server. They don't require a process actively taking up resources on your machine monitoring disk activity.

What about attachments with passwords? Or https? (assuming we're not using stupid ideas like ssl unpacking proxy)

Blocking and filtering email attachments is pretty easy. There's plenty of email gateways that remove attachments from unknown/unsafe senders and replace it with hoops a user has to jump through to get the attachment. This is enough to discourage users from opening most malware.

For websites, malware hosts can be easily blocked at the gateway level. This won't protect you if someone manages to host malware on a common site like yahoo.com but will catch the vast majority.

These days it's pretty easy to circumvent or disable Antivirus or obfuscate your malware form it. If malware manages to get itself onto a user's machine then you've already lost.

Some systems will scan the email content and try to guess the password; if they can't, they'll block the attachment.