I completely agree. While theoretically possible to do given full packet captures, it does not scale. IDS/IPS systems are not in a place to operate at this leve

I completely agree. While theoretically possible to do given full packet captures, it does not scale. IDS/IPS systems are not in a place to operate at this level and keep this much state. It's more likely that it would be detected based on the nature of the injected malicious data.