Actually drive by JS attacks and JavaScript engine exploits happen occasionally and have known to bypass browser sandboxes. In these cases the infection is completely invisible to the user and requires no downloads or execution of files.
I've seen a few false positives with BitDefender for random Lemmy instances too. It might be the heuristics being triggered by the random URL names, but it's also possible there were random exploits like the XSS vulnerability that were caught by some antivirus apps. Considering Lemmy is still a juicy target for bad actors, some precaution is probably warranted.
In general I'd look closely at the specific detection to make sure it's not flagging a suspicious JS file, etc.
Awesome! Glad I could help!
That's a very unintuitive setting.