It’s because the proxy opera uses is shared proxy IP from Surf Easy, so if people use certain IPs from vpns, anti virus programs will see that as a malice ip. Opera uses this https://www.surfeasy.com/us/en/ for their proxy in the browser. https://blogs.opera.com/news/2015/09/opera-surfeasy-vpn-combo-online-privacy/
They say VPN, but in the browser its really just a Proxy network used by many people. So proxies like this, will end up on the bad list for most anti virus softwares.
https://gist.github.com/spaze/558b7c4cd81afa7c857381254ae7bd10?permalink_comment_id=2724702 this explains it better
i see, thank you for the response!