Most if not all commercially available AVs are useless against new or advanced malware anyways because they look for signatures. Many nowadays employ behavioral analysis and sandboxing but from my experience both are not really effective and depend on the user being smart enough which is too often not the case.
Speaking of your question: if a new strain of malware decides to store part of its payload in VRAM, what do you think AV should be looking for? What's stored in VRAM cannot be executed directly anyways, it's not RAM, so whatever data is stored in VRAM must be parsed or acted upon which AV knows nothing about.
VRAM is not the only thing AVs don't scan. They also don't scan hardware devices firmware/ROMs, your computer BIOS (EFI) and all of them can contain malware as well.
If you're really paranoid you shouldn't use the x86 platform which is choke full or proprietary things and remote management features running outside of your OS (Intel ME/AMD PSP), so nothing in your OS can even know about it.