I mean, "catch pretty much everything" is a huge stretch. They only catch what they already know to look for. New stuff, or stuff hidden in ways the scanner isn't programmed to see, goes right through. I've seen malware get by because it was tucked inside code that looked totally clean. The scanners are looking for old patterns, not smart new ones. They're a good tool but acting like they're a perfect wall is just wrong.