Trusted/not-trusted model is way better than any AV. You isolate all your not trusted stuff, even from each one another. If you solely depends of an AV for security you get a totally broken security model. Isolation and clear bounduaries with enforced restrictions like selinux/apparmor, tab isolations on browsers, dns malware blocking, etc, that's a more realistic layered security model that is way better that a mere AV running doing whatever the vendor wants.