The Problem
Your security product is playing by the same rules as the threat.
Every mainstream security vendor, from the kernel-mode EDR leaders to the household antivirus brands to your ISP's bundled antivirus, builds inside the binary computing environment where malware is designed to operate. The security product and the threat share the same processor. They share the same memory. They share the same kernel. When the threat wins access to any of those shared resources, the security product is already compromised. That is not a gap in any one vendor's product. It is a property of the paradigm they all operate in.
Issue 01
Security that can be disabled by what it protects against
Every binary-domain security product can be turned off by any threat that gains kernel access. Rootkits, bootkits, and firmware implants operate below the layer where the security product was installed. The product is running. It just cannot see.
Issue 02
Protection that only recognizes what has already been seen
Signature-based detection requires the attack to have been seen somewhere else first, analyzed, and have a signature written. The window between a zero-day appearing and a signature existing is where real damage happens. Your antivirus being current is not the same as your antivirus being enough.
Issue 03
A firewall that guards the door and nothing else
Your firewall inspects port numbers. It does not read the content of traffic moving through allowed ports. It does not verify that incoming data is what it claims to be. It is a bouncer checking ID. If the threat has a valid ID, the bouncer waves it through, and your firewall never saw the attack.