Why doesn't .htacces ban execute php work?

Question

htaccess

The task would seem to be banal to the point of horror - to prohibit the execution of php in a certain folder of the site, for example: /upload/
I make .htaccess with the following content:

RemoveHandler .php
RemoveType .php
AddType application/x-httpd-php-source .php
Options -ExecCGI -Indexes
php_flag engine off

and I throw it into the /upload/ folder
, I immediately put test.php there, which ... The pancake is wonderfully executed. And it is expected that it should not.
Allowoveride All for the parent folder is registered.
If I write badbird in my .htaccess - 500 pops out, i.e. The file is being processed.
Why, then, are the instructions to prohibit the execution of .php files not executed?

Answer 1

In my notes, these directives are indicated

# запретить доступ ко всем файлам
<FilesMatch ".*">
  Order allow,deny
  Deny from all
</FilesMatch>
 
# Разрешить доступ только к файлам определенного расшерения
<FilesMatch "\.(jpg|png|gif)$|^$">
  Order deny,allow
  Allow from all
</FilesMatch>
 
# Выключим php
php_flag engine 0	
 
# для все стремных файлов сделаем тип html
RemoveHandler .*
AddType "text/html" .php .cgi .pl .fcgi .fpl .phtml .shtml .php2 .php3 .php4 .php5 .asp .jsp