The AV could do things better even without hooks. I don't know about ALSR, however dropping privileges when scanning a file that the user opened is pretty much a given in a security system.

The browser does this, the AV does not, so yeah, no AV devs seems to know about security.