Windows Defender is great, and MS has been adding really advanced protection including machine learning heuristics, etc. that make it really competitive. It is not 100% foolproof though, there's a lot of old and new viruses it will not detect.

Check out some of the virus gauntlets this channel runs Windows Defender (and other AVs) through: https://youtu.be/1DG3y3q8_9M. Even the latest Defender will often fail to detect a lot of threats. Of course, this channel is running known bad infected executables, and the best line of defense is just not to run executables from unknown sources. It's possible to just visit a malicious URL and get infected through JS though, so it gets a bit trickier.

I'm not familiar with the argument that antivirus software will increase your attack surface. That sounds interesting, do you have any links I could read up on?