Malware is way more complicated than most people realize. It is constantly changing and evolving, every single day. Therefore, detecting it must also be changing always, which is a nearly impossible task and never 100% possible. The best you can do especially for WordPress is often “best guess” when the file checksums are not correct, core files are missing or altered, things like that. Or calls to remote servers are detected within the code, but again that is very subjective.
tl;dr relying on malware detection or security plugins is a crapshoot.
