It looks like the virus checkers are not doing robust decoding that the email RFCs recommend, and that thunderbird is.  This is obviously a bug in the virus scanners.  By default, like thunderbird, the email library does its best to decode attachments.  If you want your application to reject such attachments, then in python3 you can check for defects after doing the get_payload, or you can set the policy to 'strict' (that is, raise_on_defect=True) when parsing the email.