We're running a fairly retro setup on AWS with lots of small (t3a.micro and t3a.nano) instances in autoscaling groups.
One of the groups we deal with has said 'we require AV on everything'. This effectively means we can't run anything with less than 2gb of RAM (i.e. t3a.small), which doubles or quadruples the cost of each instance.
Note that if we rearchitected to use Kubernetes or similar, we'd get a lot less burst CPU capacity for the price. And it would be a little depressing to do some much work just to install AV...