Are SQL Injection vulnerabilities in a PHP application acceptable if mod_security is enabled?
No, at least not if you ask me.
If SQL injections are acceptable for the client, there is nothing you need to worry about. You could ask yourself why they did ask you to review the scripts anyway, but I won't bother, take the money and say goodbye. There is not much to argue, it's a pretty simple answer:
If it's yes for them, they know what they do, not your business.