Your two sentences basically contradict one another, no? Apache doesn't handle brotli, so it will pass the compressed body to the underlying server undecoded, which means the underlying server is effectively exposed to attacks on this bug, if it does brotli decode on the body.