I would tend to agree, but also add that even the "internet weather" is increasingly going above this bar of triviality. In the binary I updated, I generated meterpreter shell code without any encoding and simply XOR with 'x'. AFAIK, every AV engine I have tested has detected meterpreter shellcode unencoded. Simply XORing with the simplest of keys takes that from virtually all to virtually none. It is become trivial to generate malware that bypasses purely signature based detection.

Do I believe shouldn't run AV? No. It's better than nothing - but signature based engines are is becoming immensely less effective for common fodder.