Avast antivirus has an option for disabling "Enable hardware-assisted virtualization". If it's enabled, how is it a security issue?
In theory, hardware-assisted virtualization can make hypervisor-based rootkits possible. However, this type of malware already requires extremely high privileges and is not a particular threat. Furthermore, hardware-assisted virtualization can be used by Windows to supplement its sandbox for added security. It's not a security issue so much as a feature optionally used by one theoretical kind of malware.
A hypervisor is software which is able to run a virtual operating system underneath it. The hypervisor, in other words, pretends to be real hardware so the operating system running under it doesn't need to be aware of this fact. Hardware-assisted virtualization (called VT-x for Intel and AMD-V for AMD) is simply a CPU feature that allows hypervisors to run at native performance, as if the hypervisor wasn't there.
You will not improve security by disabling hardware-assisted virtualization. Because it requires such high privileges to use in the first place, any malware that is able to use it is already able to bypass any restrictions you set. As such, Avast's option to disable this feature provides no additional security, and might actually decrease security by preventing Windows from using it in its HyperV-based sandbox.
My research suggests that you have misinterpreted the meaning of the setting, e.g., see this thread.
Avast is capable of using hardware-assisted virtualization to provide better anti-virus protection. However, because this can cause compatibility issues with other software, an option is provided to disable this functionality.
That is, if you turn off the "Enable hardware assisted virtualization" you are not telling Avast to disable hardware virtualization on the PC; rather, you are telling Avast not make use of the hardware virtualization functionality itself.
VT can be an issue, because of improper guest-isolation, where data from one VM can leak to another VM. See L1TF - L1 Terminal Fault for affected CPU and possible migitation approaches. While those containers are all under your control, the attack vector is rather theoretical.
But one certainly cannot disable VT from within the OS. Avast AntiVirus may have it's own sand-boxed container, which may either run hardware-accelerated or not. This likely affects it's startup speed and also the resource utilization, but it has no direct security implications.
site:forum.avast.com virtualization hint for possible interference with other VM. Therefore, while there is no interference with other virtual machines (depending which type of hyper-visor they use) and VTx is enabled in the BIOS, one should enable hardware-acceleration for Avast. This setting is generally all about using a type I vs. a type II hyper-visor for that sand-boxed container.
Virtualization Technology allows running an operating system in a fully sandboxed virtual computer, and even allows exposing a different CPU type and different CPU capabilities to the OS, to the extent that it is possible to simulate a CPU that isn't virtualization capable, and that itself looks and behaves like a physical CPU.
This way, it is possible to install malware that encapsulates the OS completely and thus can hide from scanners. The only difference you'd see, if you took the care to look, was a slight difference in reserved memory at startup compared to an uncompromised system, and that the CPU does no longer present VT interfaces to the OS.
Unless you are running virtual machines yourself, you wouldn't notice, so the BIOS allows disabling VT at first boot, so it is no longer possible for a virus to hide behind VT. To reenable VT, the CPU needs to be properly power-cycled, not just reset, so this setting can only be changed from the Setup, and ideally the power cycle would need manual input as well -- older machines would power down after changing the setting and require the user to press the power button again.
As a user you would leave this setting disabled until you explicitly require it. It's part of malware protection, not even a particularly good one, but one additional hoop that malware authors have to jump through, and the usual cynical approach to security applies: the zebra doesn't have to run faster than the lion, just faster than the slowest other zebra -- if infecting your computer is more effort than infecting a few thousand others, most attackers won't bother.