Not only do people install it, I see it required in corporate IT all the time. As in, they even set a VPN policy that checks your anti-virus definitions for currency and will refuse to connect if the definitions aren't current or if anti-virus is not installed. These same corporate IT who force 90 day password changes, and nonsense like 5pEAzhawh$ instead of fivepizzassoundsgoodbutdontforgetthebeer because no matter what longer is better.

I was on a site the other day, which I won't share publicly, that required "NO MORE than 6 characters, including precisely 1 number and 1 capital" (paraphrase, my emphasis) ... I definitely WTF-ed at that.

My default is 20 characters of alphanum, or 16 of "graph" (though I drop look alike characters; 32 chars if I'm entering payment details).

One has to hope they have a small limit on retries. They definitely carry commercially sensitive data and do payment processing.

What worries me is they used js to catch my attempt to use 20 chars, so they're not operating completely naively -- all I can think was it was a misinterpretation and s/most/least.

That's often due to PCI compliance which I believe mandates antivirus software.