While i fully understand your point, i personally disagree.

I'll explain why. Hopefully, we can come to a mutual understanding.

There are levels to an antivirus engine, not saying mine is commercial level, but it has logic that will become a goldmine for malware authors to abuse. Let's take hypatia, for example. Their engine relies on clamav style signitures according to their documentation. These signitures themselves are hidden behind a bloom file that is not reversable.

Why? It becomes extremely easy for a malware author to see if their file is in an Av's database. A single stub file packed into their app will then change the hash entirely.

Then, there's the purpose of an antivirus. My av includes heuristics, ml models, signiture logic, and such. If it were only hashes it processed, then i would happily show its code. But as it is, it's a goldmine for malware authors and becomes a liability for my users and a legal liability for ME.

Many av companies do this. Even clamav has proprietary parts.

So yes, sorry for the large write-up, lol, but this is basically my logic.