They can bypass antivirus. You just have to turn that on... Under Mail Policy/Mail Flow Policies, you can click on the "Trusted" flow policy, and change which security features are applied to those mails from those IPs.
Yes, turning off AV is more dangerous that turning off spam... By orders of magnitude. Lots of spam is not actually malicious code. AV is known malicious code. In my opinion there's no good reason to turn it off. BUT you can do it if you must...
That is based on category, and there's a cloud service that it checks the url against.
And now in 15.0 (currently in Limited Deployment) it can remediate urls that are marked ok but later discovered to be bad, the same way it does with files.
