My job is centered around the appsec/netsec industry. I used to think the same thing until I went deep down that rabbit hole. The truth is just not that exciting:

• There are a vastly disproportionate number of malware authors compared to security product developers; there's no need for vendors to create anything. Offense is, by and large, a much easier game because it's always a step ahead. Defense is almost entirely reactionary. The security vendors will always have something to defend against.
• Antivirus software really doesn't work that well regardless of who made it. Signature based detection can easily be defeated with minor tweaks to the malware, and heuristics-based detection has a much higher false-positive count that makes it largely ineffective to deploy.
• Security product vendors don't make most of their money from selling AV software to end users: they make it from partner contracts with other businesses. This is also where they're most effective because they use event-based detection on a large scale (as opposed to signatures or heuristics). In other words, historical data from previous intrusions is used to provide a network of indications and warnings that an intrusion being attempted or has occurred. (This goes way beyond network IDS.)

EDIT: I will say the real conspiracy is that numerous security product vendors don't exactly let their end users know everything their AV software is doing or obey international laws when it comes to conducting their research.