Imagine anti-virus A detects "0xAABBCCDEEFF" as a virus, okay? I submit a transaction which has the script, simply:-
0xAABBCCDDEEFF OP_DUP OP_EQUALVERIFY
At this point, basically, you're sending "0xAABBCCDDEEFF" to the mempool, duplicating it (OP_DUP), testing if 0xAABBCCDDEEFF and itself (OP_DUP) are the same, if so, the transaction is valid.
So, now it's a valid transaction, it'll be mined, and, it'll be put into the blockchain, this is where issues occur, suddenly,
everybody who is running that anti-virus suddenly gets a warning, and, their antivirus starts quarantining the blockchain!What's to stop this from occurring? It may cost an attacker a mBTC or so to actually pay for a transaction with a virus binary attached to it (As it'll probably be a few tens of KB), but, until the anti-virus vendor manually marks the blockchain as not a virus, surely it'll show up in a scan-time scan (And maybe even runtime, as, Bitcoin-QT will have "0xAABBCCDDEEFF" in memory).