With execute only permission it's possible to bypass antiviral scanner and in some cases antiviral monitor.
vulners.com/securityvulns/securityvulns:doc:6956