I see. And yes there have been some module/syntax changes between apache versions that makes one less motivated to upgrade. Also upgrading doesn't always give you better security, you might be introducing a new issue/bug. But i could see their reasoning, why not to upgrade/change the version.

The scanner most likely does a simple version compare. The scanner assumes anything under version X.Y == vulnerable. If it would be hiding or faking the vendor and version to latest IIS (or apache, or nginx or etc), possible it would simply report all is A-Okay. Unless the scanner really test the actual exploit/vulnerabilities, i assume the simple version compare happens.

Though i'm quite certain the malware didn't get *there via a method that only utilises the webserver; more likely a poor coded (php, perl, etc) script allowed 3rd parties to download/write to disk of your webserver.

If for example shellshock wasn't patched in time, and there was a vulnerable cgi script or similar on the website/server, it could have been that script+bash, that has been exploited. But that doesn't make the webserver vulnerable. (even though the malicious upload/ action was executed via the webserver)