Flawed Logic?

Not sure where to post this, mods please relocate to the most appropriate location, thanks.
 
I have been using WRSA on and off for a few years now, was even a beta tester for a while, but since the recent purchase of new Win 10 laptop I've decided to uninstall it and keep it off for the foreseeable future and I make this request to WRSA designers / developers: please block and remove known malware as it arrives rather than just monitoring and watching what happens, only then acting.
 
I undertand the philosophy of WRSA and I am not suggesting a removal of any of the monitoring functionality, but when I can see a malware attachment on an email, or folder, and WRSA simply waits until activited, then it's an awful lot of trust to place in a product that it will protect a user when the payload is still sitting there waiting to spring into action. I simply don't want malware on my system, period.I think it's a kind of flawed logic to allow known or suspected malware to reside on a system and only act when it's allowed to start to do it's mischief. This point comes up often on these forums and elsewhere.
 
Of course as an experienced user I am not going to download an unknown attachment, but increasingly with people's email addresses being spoofed it's becoming increasingly difficult, especially for less experienced users, to spot these tricks. Even experienced users are fallible, we can be tired at the long of hard day, or in a rush, and inadvertantly click on a payload.
 
A solution of a quick online lookup by WRSA of newly arriving / recent files against a database then immediately quaranteening the suspicious file would not in my opinion bloat WRSA to become like most other AV softwares and would instill confidence in many users, not least those who have trialled WRSA then watch as it does not act immediately on malware, not understand the philosophy then move elsewhere to another software.
 
I really like what you guys are doing but I think you need to understand real users and their concerns slightly more and ensure the WRSA removes or quaranteens immediately what is known to be malware in a visible way before it even is allowed to execute.
 
Thanks for your consideration.