I think you're on the right track, but I don't believe this is about AV on the desktop. Enterprise-grade AV is a much bigger business, and tends to get pushed in to categories like IDS/IPS, web proxies, and email scanning. This all of happens "in the network" before packets ever hit your pc. It's extremely regex heavy, and in order to scan at high data rates we often rely on purpose-built regex accelerator cards.