What confuses me is that you have stated previously that executing a file from the Desktop is somehow not "real world", and should be differentiated from a file run from elsewhere (C:\Downloads, C:\Users\appdata\roaming, etc). In the same vein, how would a video authors decision to first do a custom scan then run undetected files from a malware pack in a C:\Malware directory be inferior?
Webroot does use folder priority. That's how the product has been designed, I am not designing it. Other products of this sort are McAfee, Eset that uses emulation on downloaded files, Avast with their cyber capture that needs the MOTW. These products have additional systems that kick in only when the file is downloaded. The design decision of the vendor should be respected. Malware doesn't just come from the sky, It needs to be downloaded or saved from email (same thing). You cannot always place all products under one umbrella and test them the same way.
It is not even folder priority, it monitors the chain of events. Files created by browser are examined with a more aggressive rule set. AVs like Norton also take into account the website file came from.
To this point, I agree with Lynx. But I don't agree that users will start playing hide-and-seek or whack-a-mole, creating HIPS rules, tweaking heuristics. This is something that very small minority will do. Vast majority of users use Defender with no tweaks whatsoever.
But whatever, let's tweak them. They will still fail.
Finally, the comment "Many products control false positives by using more aggressive screening of downloads, as opposed to local files." should be questioned. This is implying that an AM application utilizes some sort of Folder Priority, when the emphasis should actually be placed the potential system changes made by the execution the malicious file, either as a direct result of it or by the concurrent spawning of a LoLbin.
This in the Webroot world is impossible, as it automatically whitelists and excludes absolutely all trusted binaries, which LOLBins are... it does not monitor them at all or scan them. This is why everyone would cast a doubt over the Webroot effectivness, which I did and then I was attacked.
