Yes, Cpanel does occasionally overwrite antivirus.exim during updates and I've
had my antivirus.exim nuked on several occasions without knowing about it
which prompted me to just write a cron job to check the checksum of the file
periodically and replace the file with my copy if changed.
A little more disturbing is that I've had Cpanel blow away my Exim config a few
times as well which really pissed me off since I have a whole lot plugged
into the Exim configuration and it was lucky I had backups.
I recommend everyone keep a backup copy of all "/etc/exim*" files