All AVs can or do send suspicious files to their servers for analysis. Why is this a surprise?