And secondly, aren't the antivirus blocking or flagging these websites?
Most of the major ones are. For example, I'm using uBlock Origin and coinhive is blocked by default.
There are also a few chrome extensions that do the trick (i.e
No Coin), and a few
ready-to-use host files that block most of the major mining script websites.