At least in the card processing space, one of the PCI requirements is "5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers)."
The phrase "commonly affected" is the place to make an argument here, but I'm sure people take the easy option of just running an antivirus.
Right, and that requirement loses all of its nuance when it lands on someone's checklist as "anti-virus software on PCs and servers".
When my company gets asked why we answer "no" to that question, my canned response is "because anti-virus software would almost certainly be the most exploitable vector on our systems".
The phrase "commonly affected" is the place to make an argument here, but I'm sure people take the easy option of just running an antivirus.