I completely agree. While theoretically possible to do given full packet captures, it does not scale. IDS/IPS systems are not in a place to operate at this level and keep this much state.
It's more likely that it would be detected based on the nature of the injected malicious data.
It's more likely that it would be detected based on the nature of the injected malicious data.