I'm not surprised. The antivirus sector seems to prey on people as much as the virus makers. I had my PC infected accidentally by norton antivirus a few years ago. They snuck it onto my system by hiding themselves in an oracle java update. They didn't install right away, waited a bit so I couldn't immediately link it back to what caused it. The uninstall function in programs and settings was a misdirection and threw an obscure error. The uninstaller downloadable from their website would pretend to uninstall, require a reboot, and after the reboot the malware would reseat itself on my system. Eventually I had to start up in safe mode and painstakingly go through my system file by file, and registry key by registry key, to root it out. They know all the techniques the viruses use, and they use most of them.

That was when I decided to stop using Oracle Java on all my personal systems and minimize my use of Oracle products on a professional basis. Learning they were a malware distributor was the drop that tipped the bucket.