I think it is because a lot of these new "Anti-Malware" products are either from young developers who barely know what they are doing, or just a vendor who wants to overtake an existing one with the end goal of making money on way or another. For example, a new vendor might arise with a free Anti-Malware product and they may do something like sell data to make a profit (covered in the privacy policy), or they may gain attention and a user-base through the free product and then drop a paid product, attracting the existing customers to the paid version, thus resulting in their fans purchasing and making them a profit.
Then again, there are tons of kids these days trying to make said products in the .NET Framework. Make sure to steer clear from them with the exception of a few, since more often than not, any .NET-based product claiming to be an Anti-Malware/Anti-Virus is useless and usually doesn't proceed past basic checksum hash detection. Which is obsolete and literally useless if you really need a product to protect you.
Checksum hash detection is definitely obsolete in terms of identification for new zero-day malware, however it can still be useful for detecting threats before they are given the chance to actually execute, as
@Umbra said. If you have zero-day behavioral components then that is great too obviously, but if the malware can execute at all then it does give it a chance to exploit and escape the protection... Believe it or not, standalone Behavior Blocker/Host Intrusion Prevention Systems can be easily defeated and evaded (even if it monitors the activity being executed by the monitored program) these days due to them being developed and evolving around user-mode these days (due to kernel-mode patching limitations on x64), and the work around for this would be usage of the hyper-visor for real virtualization (sandboxing and then monitoring within the sandbox), but learning to do such work can be very time consuming and for a vendor to implement this technology it can be very pricey.
The reason checksum hash detection is obsolete is simply due to the fact that malware can be shipped back into the wild with a new checksum simply after modifying one byte of the Portable Executable, then it will be undetected via signatures. Static heuristics goes a long way in the Anti-Virus industry but more often than not, the security product will have a useless memory scanner (for whatever reason), and therefore simple packing techniques will completely evade the detection (since if a product has an advanced and decent memory scanner, it can attempt to apply the heuristics after the sample has unpacked itself in memory -> e.g. dump it to disk after it's unpacked itself, then apply the scanning, if found to be clean then resume the original process from it's suspended mode).
I don't think anything will change really, these products just pop out of no where like there is no tomorrow... Too many people want to release their new product and get a slice of cake but have nothing to bring to the table that doesn't already exist, and even myself have tried to do something like that before.
I agree that we have enough AM products on the market already, there is already many to choose from... But people get interested in the security industry and want to own something "big" and "successful" themselves, so they spend tons of time on it, and even if it does turn out to be good they usually wait years before getting barely any market share since the already successful vendors are on-top for usage by people due to being known more widely and having existing for longer.
Even AV vendors like Norton have admitted that the AV industry is dead and obsolete (I may have gotten that wrong, I apologize if I did), but it makes a lot of people money. The security industry can pay very well for some, not always though... And people have jobs which pays them a lot of money I guess, even if they aren't really doing much work. I would imagine that the average Avast engineer would make around £100,000-£200,000 a year or maybe more due to how much money Avast probably make, but I am not really sure.
I would say that layered protection would be the way to go anyway: web protection (anti-phishing, anti-exploit, help prevent the download in the first place), real-time for signatures and static heuristics (to help prevent the download or transfer from removable device in the first place), BB/HIPS (real-time monitoring of untrusted programs), and/or sandbox if required. But those AV products with awful dynamic protection, yeah I would say they are obsolete IMO.
But yeah I find this thread really interesting, waiting to see what other people say now...
