Sure maybe the memory is freed (or paged out) as pressure rises. The former is however not guaranteed in any way and requires that Windows Defender (or whatever other application) actively monitor the memory situation, taking appropriate action as it changes.
That's something I'd expect a database to do. A virus scanner? Not so much.
every new dotnet package, powershell module, go module, container image, etc that i pull and want to start using results in about 10 minutes of complete system unavailability due to defender going off the rails with ram and cpu consumption. it used to be i’d have to wait for the compiler to build, now i have to wait for defender to defend.
That's something I'd expect a database to do. A virus scanner? Not so much.