If malware exploits a privilege escalation vuln, what's the AV going to do about it when it's reduced to the software equivalent of a UK police officer? Observe and report? Stop or I'll say "stop" again?

AV requires great power, which requires great responsibility. The second part is what often eludes AV developers.