They want us to be compliant, not secure
I can confirm this. We had to install virus scanners on our self-driving car Linux boxes which are disconnected from any networks...
Fun part is that the AV scanner sometimes takes so much CPU time that the pedestrian detection algorithm fails and the car has an increased chances hitting them.