Depends what your goal and problem is.
MIT showed that email had to be filtered at the users end to prevent errors of deleting valid emails. OTOH ISPs and their connectors would like to filter the bulk spam before it clogs up everything and costs too much while delaying other mail.
Now if email per se could attack the ISPs directly or their web links then it would be better to filter email first.
At the PC level the same consideration exists. If the scumware can cause damage just by getting in then you must filter it first. Better to prevent then to fix problems. And this will depend on the architecture of the device in use. Most current PCs and similar items are insecure from the gitgo even if you filter before and and address the issue after the stuff gets into the device.
Absolutely secure architecture is possible. I did it twice. Once in the 90s for DOS type devices, and could do it again for graphics oriented win type devices. But nobody will buy them and the establishment including the antivirus companies would fight it hard as would NSA and others who prefer to be able to get into our computer than to have us keep the other bad guys out of them.