I don't think so. This rule for example probably block attacks on a dozen old WordPress vulnerabilities.

And a rule that denies everything blocks all vulnerabilities entirely.

A false positive from a conservative evaluation of a query parameter or header value is one thing, conceivably understandable. A false positive due to the content of a blog post is something else altogether.