Aye. And imagine how much damage false-positives can have on smaller software companies. A company like MS runs all of its binaries through the major virus scanners as a matter of course for any release build, not just to check for viruses but to make sure that they don't get tagged by a broken heuristic detector or some such. But not every company has that luxury (and even so, it didn't save XP from McAfee's blunder).

Besides which, all AV amounts to variations on turd polishing. You'll never achieve robust security through black-list methods.