It is a fact that antivirus software can't detect all the spyware/viruses/malware that exist. And when they get detected, new ones are created.
An example is the pegasus spyware for ios created by the NSO group. There is also an android version available. And there are many spyware for windows computers which claim to be undetectable. And there are probably many more for different OS that are not made public.
So what can you do about a possible spyware on your device that your antivirus/antispyware doesn't detect?