I could be wrong but I don’t believe that even these days anti viruses look at behavioral patterns to identify viruses. They look for signatures of running executables to match malicious patterns in their database. Instead dev drives recommendations are because of performance. There’s substantial overhead & dev patterns, particularly for native code like C/C++/Rust etc, create a lot of intermediary files as part of the build and AV can cause a slowdown. Traditionally the advice for Windows devs was to turn off Defender or exclude your project folders but maybe there was a reason dev drives were still beneficial (maybe it can avoid even more work by working at a drive level).