AV Scanner should have writting and on access scan.

That’s the way CAVS was designed (mostly for low resource usage). It doesn’t matter if the malware lays dormant. As long as it does not execute and get CPU cycles to do what it wants to.