I've done the same in caddy:

@multipart header_regexp Content-Type (?i)multipart respond @multipart 403

@uploads_php path_regexp uploads_php ^/(?:./)?wp-content/uploads/.\.php(?:/.*)?respond @uploads_php 404

Plus the php.ini changes, "session.upload_progress.enabled = Off" and strict mode. Let's hope it holds until then

    @multipart header_regexp Content-Type (?i)multipart
    respond @multipart 403

    @uploads_php path_regexp uploads_php ^/(?:.*/)?wp-content/uploads/.*\.php(?:/.*)?
    respond @uploads_php 404