Re-combining binaries to be in different but functionally equivalent forms which evade anti-virus is a fairly trivial problem. There is a class of tools "obsfucation tools" to automate this process which can either re-arrange portions of the binary or encrypt their contents. Can your average end user do it? No. But it would be trivial for a determined attacker.
Some AV products have some protection against this (by predicting and/or noticing the output from the most common tools), but it's not reasonable or feasible for any such mechanism to detect all potential obsfucations. Plus the more you detect, the more false positives you will get.
In designing a security policy, making a whitelist would probably be easier than a blacklist. Likewise, other permissions and security settings should be set outside of simply installing a managed anti-virus. For example, making sure users do not have permission to run common software installers or add entries to the system startup.