Hopefully AVG itself prevents such emails from passing. After all, it sees all emails, and can modify all emails. Nothing prevents it from removing any "CLEAN"-stamp on incoming email and replacing it with its own CLEAN/DIRTY stamp. In other words, your objection is IMO a non-issue. Nothing ridiculous about it.

However, changing message headers is a problem, when the message has been signed. I therefore agree that changing existing headers is not as good a solution as adding a clean/dirty-header is. But it is in no way less safe because of your above idea.