There are many ways to infect a site – and many ways to hide that infection from the ‘popular’ security plugins.
One way to detect malicious code is via a file-hash-compare function. You may need to write your own though (I did, but it’s not perfect). That function would compare each file’s hash with a known good value in a database. You would previously have to hash an entire site – making sure it is clean, then run the hash-compare function against all files. Not an easy thing to do. (Even the one that I wrote doesn’t work perfectly. ANd you have to remember to run it…)
If you are already infected (as you are), manual intervention is advised. You need to change all credentials (FTP, hosting, database), remove all suspect files, all (from known good source, not just an update) WP core and themes and plugins, and more – then do it all again.
There may also be some malware hidden in the posts table. And fake ico files that contain code.
There are many googles/bings/ducks on how to clean a WP site. I have my own procedure (here https://www.securitydawg.com/recovering-from-a-hacked-wordpress-site/ ). It takes a bit of work and time, and monitoring afterwards.
Good luck.