Hello, the behavior you are describing sounds like a bug, which was fixed already in the latest Plesk Obsidian 18.0.68 Update 2 release from today:
Enabling or disabling ModSecurity rule set updates no longer resets the rule IDs specified in the “Security rule IDs” textbox to their default values. (PPPM-14876)