Yes, and it doesn't even require much skill.
I tried this once. As a purely academic exercise with no intention to make any use of it, I wrote the most simple trojan imaginable in C++: Simply launch a new background process which opens a TCP server socket and forwards everything that comes in to
system. I did not even try to obfuscate what it was doing in any way. This is all pretty basic stuff which I would expect any junior programmer to cobble together in a few hours, even if they haven't done anything like that before. To be fair, this would not have been that dangerous, because it didn't try to survive a system reboot, it wouldn't have worked on most consumer networks because it would have required port forwarding if behind NAT and it wouldn't have worked on a properly hardened server because the port would have been blocked by a firewall, but I wanted to keep things as simple as possible
Then I submitted it to VirusTotal. I assumed it would get a heuristic hit from most AV engines.
To my surprise, only two engines got a hit, and both mistook it for some known malware which weren't even trojans (in other words, false positives). Virus scanners are very good at catching known malware samples by their signatures, but when it comes to detecting unknown malware, they are extremely unreliable (despite what their marketing claims). The reason for this is that it is actually very difficult to write a program which can determine what an arbitrary other program will do when executed without actually executing it.
That means you can not assume that a malware scanner will protect you from any malware until it reached the labs of the developer.