Avast itself recently became malware and got its extensions pulled. Another reason for architectural security is that every third party program capable of updating itself has one unfixable vulnerability: the almighty dollar. A company gets bought out or an individual gets bribed and suddenly a stranger's in your house.

My friends sometimes have to download odd software from the net and their AV's have helped them avoid disasters.

Well, 2020 was not a year of Linux of desktop. How many people use Linux AND fail to notice obvious signs AND download malware/viruses common enough to be detected by antiviruses?

Did they download a random anti-virus program from the net?

Which ones are the secure ones?

How did they know it was avoided? Did a popup from the software they installed tell them so?

Noticed a popup "Malware has been disinfected" and the bad files were automatically moved to a quarantine. Don't remember the AV which was used.