I guess you could just allow ONE range which seems like a good compromise and defeat the attack?

     RewriteCond %{HTTP:range} !(^bytes=[^,]+(,[^,]+){0,1}$|^$)
     RewriteRule .* - [F]

(for those that don't speak regex: the 0,1 allows either one or none range headers to be accepted, more or less will fail to be served anything)

That will allow downloads to still resume and it works in any version of apache.

If you want to limit to one then ? is simpler. Doesn't that version limit to 1+0-1 -> 1-2 though? But why bother with a complex anchored regex when you can just search for "," in the range header.

Or just Apache's Option 1 as in your post above?