In at least some AV products (Kaspersky is one I'm familiar with), the local application has signatures and heuristic/behaviour controls. What it's doing is (I think) three things:
- If there's doubt (heuristics and behaviour detection are statistical systems so they might not be 100% sure how to classify something), or it looks wrong but doesn't match a signature, uploading the file can allow human examination, and updating of signatures so that other systems are more exactly protected.
- If its not clear or the user has specified they will choose all actions, then it can be useful to check how other users have handled the same file. If most block it, the user can be told so. (I've used this facility quite a lot for a sense of comfort on "odd" system processes that I can't tell are needed or wasting resources.)
- Anti malware companies also track malware quite a lot. If they can't get feedback what has been detected (and what variants or novel behaviours seen), they can't do their own work as accurately. To take a simple example, Stuxnet apparently tried to attack only if it detected certain hardware and geographical regions. An antivirus company in (say) Canada just might never see many files to analyse them, unless their software in other locations can autoforward suspect files to them.
Against that, a lot of the time a hash (used as a numeric value that uniquely identifies a file) is enough, and much quicker to send, so I would expect a lot of the time, that is what's sent and checked. You can see this on the website virustotal.com which let's you enter a hash of a file instead of uploading the entire file itself.
Yes there are security concerns. But given the power within the system granted to an antimalware package, if you don't trust them, you'll have far bigger concerns than their cloud facility.....