[digi_owl]

Another thing is that actions malware take and actions legitimate "power user" software takes are separated only by context. Thus automated behavior analysis is always going to produce false positives.

[voltagex_]

Is there much behaviour analysis done by consumer AV? Even Defender seems to be mostly signature based.

[neko_koneko]

Yep. Malware is constantly repacked/encrypted. It is impractical/impossible to write static unpacking engines for every type of malware packing technique, so behavioral analysis engine is a must (btw, behavioral engines still detect malware using signatures).