One issue that can make this behavior come to the attention of the user is
the choice of what kind of scan is scheduled. Last I read it, the help for
the product recommends scheduling quickscans, and doing a full scan either
when something is found, or on a less frequent scheduled basis. (The UI for
defender doesn't allow for this more complex scheduling, but, say, a monthly
full scan can be scheduled using the Windows scheduled tasks facility, with
a bit of effort.)
Full scans can be quite resource intensive, and might be annoying if they
occur unexpectedly. Quickscans are quite a bit less intensive--and are
designed to catch in-place spyware--so I believe that the help
recommendation is a good one to follow, and doesn't lessen your protection.
--