I dont think you got my point but I do get your point. Always excess of rules will lead to heavy load on Apache, so we should not try adding oldest of exploits. Instead software must be update. A real time virus scanner must be used to stop uploading of shells and mailers instead.
A Real time virus scanner is what we've, but that doesn't stop all uploads of malicious codes, most LInux antivirus doesn't detect nothing, almost nothing, the best is clamav with maldet signatures and some other signatures, plus we make our own, but that also takes memory and is very expensive to apache, like you said.
Sometimes some kind of exploits, are similiar, and a construction of one rule, can avoid NNNN exploits.
Upgrade the software, is like i said, if it is your sites great, but normally this is not your sites, and clients don't want upgrades. Of course rules can't cover all exploits, it's impossible in terms of resources. But some of them, like this one, is BIG AND VERY USED, so it should be stoped, do a google search, there're thousands of possible sites to attack. Also, like i said, it's possible to upload a shell or some kind of script to attack, without being detected by antivirus.
