Nimbostratus
EmployeeI'm not sure you can definitively answer this questions, but working in support I can say that many users do leverage this extensively.
My experience with customization is that it usually happens after IT tests the ASM and discovers their settings are incorrect for the environment, or after some thoughtful attacker does it for them.
Like most features of the ASM it works best if the ASM administrator, Web Application Administrator, Network Administrator, and Developers all talk about the configuration and pick settings that make sense for their environment.