You are mixing two different concepts here: storage and execution.
When you use the SMB share, you are using the remote machine as the storage and mounting it locally. Real time protection will deny access to infected files, so you won't be even able to copy them to another folder. If configured to scan and take action on remote drives, your antivirus will try to quarantine infected files on the remote host.
If you are connected to a large remote share (a couple hundred terabytes), don't expect your antivirus to scan everything on that share: that would mean your machine downloading everything and scanning the files locally. Multiply that traffic by everyone connected to the share and the storage and the router would be pretty sad.
On the other hand, if you try to execute, copy or open anything from a remote share, your antivirus will step on and scan the file before giving you control.
When you say you want to execute malware on the remote machine, we are using the execution concept. Here your machine have nothing to do with anything. The execution will run on the remote machine, running software stored on the remote machine. Your antivirus will not notice anything, because it's entirely outside of its reach.