Code reviews mean Fuck all.
The key features of AV software:
1. Generally runs as root process or with authority of user.
2. Reconfigurable from central location
3. Downloadable updates
4. Uploads data to "central servers"
You can have the cleanest code for review, but a 30 second change can pull in all the data you need.
There is an increase in the lack of user control for all modern apps, these fucking companies will just NOT leave it alone.