It eats up a lot of CPU. It doesn’t seem like much help in a default update enabled system where you are using a regular user account instead of an administrator account.
In addition, anti-virus and real time scanning is itself potential surface area for an exploit (for example a few years back there was an exploit based on Norton antivirus email scanner).
It uses next to no system resources (issues like this aside), it integrates perfectly with Windows (it comes from Microsoft, after all), it's reasonably effective (to the chagrin of AV vendors the world over), and it isn't intrusive.
If you have a Pro version of Windows there is a group policy setting for it. [1]
If you have Home, you can achieve the same effect by manually tweaking the registry. [2]
--
[1] Computer Configuration > Administrative Templates > Windows Components > Windows Defender Antivirus > Real-time Protection
[2] HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\"DisableRealtimeMonitoring"=dword:00000001
but it does integrate with the system well since its from Microsoft.
For me, no.
I grew up in the era of internet wild-west and I understand why some of us still feel the need to operate with multiple levels of (perceived) safety even today.
That said, I think most of it is really foolish crap now. The sorts of exploits that are out in the wild that you should actually worry about will go right through defender like a modern bunker buster.
It's really upsetting to me when you think about how much performance/energy/UX latency/frustration/et. al. is being spent in hopes of achieving a minor incremental improvement in security. Windows defender == TSA for your PC.
If you know to not download & run executable files from sketchy websites, you are basically already at the limits of what defender is effectively achieving on your local machine.