If you look at how many virus signatures need to be at the ready, any antivirus better use RAM since leaving that on disk would cause the machine to work poorly.

So, in short, the more virus signatures, the bigger the overhead.