It's only slow at file IO, yeah.
Windows Defender protects from Windows malware entering via WSL and Linux malware as well.
For example Windows Defender has caught comprimised npm modules inside WSL.
What I don’t understand is why antivirus has to second guess the user.