Background (not necessary to read):
I've used a few different major AV programs day-to-day over the years, and not one has ever informed me I was running code with known vulnerabilities.
Not only does this bother me since it leaves me open to direct attack from someone aware of those vulnerabilities, but it also means that, if someone with basic intelligence were to copy the vulnerable code from one application for use in a piece of malware, they could do so with the assurance that their code would be immune from AV detection; it would require no thought, and minimal low-level coding ability.
Since the job of AV is to protect me from malware (intentional or otherwise), why isn't this done? Are there legal issues, or do malware programs tend to be easier to recognize because they tend to be smaller than legitimate programs?
...Or have I just let the cat out of the bag, and no one here has ever run across malware designed using that strategy? :P