ModSecurity will surely be a great add-on to aaPanel.
But I have tried to use https://ddostest.me to see if Modsecurity can help mitigate a DDoS attack but it failed. Tried to test free Cloudflare and it failed to too.
Good thing is OpenLiteSpeed webserver has an inbuild DDoS mitigation rule that works flawless.