You are paying a price for the lightness. I will quote an interesting post I saw on this subject:
Link to Chart: https://www.av-comparatives.org/comparison/?usertype=consumer&chart_chart=chart4&chart_year=2019&chart_month=4&chart_sort=1&chart_zoom=0...
www.wilderssecurity.com
Ultra Male said:
↑
anon:
That leads to on-execution scan/detection only.
i.e. =
Today you run a full scan, you have the X malware but your AV signature database miss it.
Tomorrow, a new signature for the X malware is added but the file (which is already scanned) remains with the same hash = whitelisted => undetected.