The best part is in the comments.

You’re right, he might have a backported patch and not be vulnerable to any of the several CVEs for this version of Apache. But also, his server might be really easy to hack. Rather than confirming that his server is secure, he blocked me when I reported the issue.