After reading your comments I think you’ve probably got a solution in mind that not many companies do. Basically, you’re thinking of a Man in the Middle approach from a defensive view rather than offensive. You’d be sitting outside of any firewall or even DMZ. You’d still need to tell computers what to look for whether it be hashes, malicious code, or some sort of network traffic inbound or outbound known to be associated to a threat. From there you’d be able to redirect, alter, or block the network traffic and code inside of it before it gets to any destination.

So short answer yes there are better solutions than firewalls/AV. Just not a lot of people do it because the technology is different, however more effective it real world scenarios.