its a matter of who you want to trust.
- your Antivirus program that can report false positives
- the Electrum developers that have released the software for a long time
- or no one.

for most people it is enough to verify the PGP signature of Electrum and be sure that it is released by the real developers and is not fake one. and then they ignore their AV.
if you want to trust no one then you will have to go through the source code which can be found here https://github.com/spesmilo/electrum and then when you trusted the "code" you need to compile it yourself and then trust the compiled .exe and ignore your AV.