Because XSS is not a computer virus, but an attack vector.
Wikipedia says a computer virus is:
A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a computer virus, a metaphor derived from biological viruses.
By this definition, JavaScript files (.js) could very much be computer viruses. However, Cross-site scripting (XSS) is an attack vector where injected JavaScript code is executed in environments where such input is unexpected, for instance in form fields on a website. XSS is not a specific type of JavaScript code, it is technically any JavaScript code that executes in a place where it is not intended.
Therefore, detecting XSS is not the same as detecting a virus, since an antivirus would not know whether JavaScript code is running intentionally or not. Of course, certain actions like downloading suspicious files etc could be detected.
Protection against XSS is usually done by (1) safe output encoding, where HTML/JS code is not executed but just rendered plain text. and (2) by conducting input validation, rejecting inputs that potentially contain HTML/JS code.