The root cause is that the security model of Unix that everyone copied isn't compatible with the modern world. The OS never asks what resources you want to allow a given program to access, instead it ass-u-me-s that it should have full run of everything, and just trusts the program to do the right thing.
So antivirus programs were invented to serve as a "no-fly-list" type system.... only programs on the list are stopped. This worked well until methods for changing the signature of programs got up to speed. Imagine a terrorist being able to make up a name before trying to buy/board a flight... this is where we are now.
Until we get the OS to ask what resources a program should be allowed... things will keep getting worse.