Using anti-virus and other security programs can certainly spy on you. Depending on what you consider spying even reputable software send diagnostic information to their manufacturers and don't always notify you of this.
There are also several malicious security tools in existence (see here). These might include nasty surprises like key loggers, back doors and such to compromise your security. It might sound a bit paranoid but the attacker could even watch your screen and webcam while you use use VPN/TOR. It is not uncommon for bogus anti-virus software to be able to disable reputable anti-virus products.
There is an ongoing discussion about the security of anti-virus software in general. I'd summarize the different arguments this way:
- There is no financial sense to spy (too much) on customers. There is too great a risk for an information leak by a distraught former employee or subcontractor.
- The company might be persuaded (or infiltrated) by a government agency. Information gathering can be 'piggybacked' to large transfers like virus definition updates.
The hackers (or some agency) could indeed target the anti-virus software's vulnerable features. Essentially every non-trivial program is vulnerable in some aspect, and your security is still only as strong as its weakest link. For example, the attacker could gain access to functionality designed to track a stolen computer (essentially a back door that you've authorized). Whatever they do then is usually not in any way visible to the user of the computer.