Endpoint Protection loophole on new files?

We were told that Symantec Endpoint Protection, and most virus engines in general, has some kind of vulnerability that allow certain virus/malware to be written to disk and execute before realtime protection can detect them.

Is this true?  Are there any known cases?  Are there any remedies to patch things up without implementing a full scan engine solution or scripted disk scan?  Scan engine introduce too much dependencies and complexity.  And my latest impression seems that DoScan wasn't meant to be controlled programatically.  There aren't even a way to create log file and verify result anymore.

Thanks.