Sorry to say that your misconception of pc security is lacking some small parts.
If a program or tool let´s say JuroJin (trusted installer and known as one of the tools for this scam) makes such a path exclusion a good AV solution should alarm the user directly. This is a
baseline security breach.
Sadly only some consumer AV-Systems (Microsoft Defender, Bitdefender Total Security, Kaspersky Plus/Premium and some others) have the abilty to detect this kind of attack on a system. Most solutions are on enterprise level.
An automatically created path exclusion without user consent is a baseline‑security breach (even bypassed through UAC mechanics).
- A core protection layer is disabled. The excluded folder is no longer scanned, creating a blind spot attackers can exploit.
- It matches known defense‑evasion behavior. Ransomware, loaders, APT groups, and sideloading attacks commonly add exclusions to hide activity.
- System integrity is broken. Baseline security assumes protections behave as expected. An unsolicited exclusion violates that assumption, regardless of whether the tool is signed.