Where I used to ork, we ran AV software on SQL Server boxes as well. We were able to set up scanning exclusions for specific groups of servers, but by default had the default set of exclusions, rather than the SQL set (or the IIS set). This meant we had to let the server team know the server purpose before it got put to use.

Occasionally got hit by AV updates that wanted servers rebooted(!), and then gave them the default set of exclusions...