That test clearly shows the difference between 'leaktests' and 'real malware'. As we have mentioned several times at various places before, we don't design our software to block leaktests, we design our software to protect our customers from real malware.
The problem with these leak tests is that they are only partially simulating threats. If they would really act like malware, nobody could run them safely. So they are actually non-harmful programs by design, which are therefore not detected properly too. Which is expected of course.
All those leak tests tools just proof that vendors have adapted special additional routines to block the leaktests, nothing more. We're still waiting for real malware samples that effectively use one of these so called leaks that we don't cover, and bypass our protection.