Antivirus/antimalware detection depends heavily on its definitions/signatures . If those are outdated, new malware variants may not be recognized. Quentin Docter explains that the "definitions database" is a core antivirus component and that its effectiveness depends on "the frequency of updates and the comprehensiveness of the database signatures." He adds that new signatures are discovered frequently and added to the database, meaning stale definitions leave gaps.
Docter is also explicit that security software "is not perfect" and that malware may get around it, "especially a new threat (and especially if you haven't updated your definitions lately)." That statement directly matches this scenario: the software exists, but it failed to detect the infection-most likely because the detection data wasn't current.
The other answers don't fit as well: folder permissions and user permissions can limit what malware can change, but they don't explain why security software didn't detect it . Port security relates to network access control, not local signature detection. Therefore, Outdated definitions (B) is the best explanation.