It's actually harder to detect that. The * is expanded before the arguments are sent to rm, so it just sees a list of directories like /bin /usr /dev /sbin /home and so on.

You could implement logic to detect that case, but at that point you're just playing whackamole.

If you try to put in safeguards for every possible system-nuking command someone with root rights might type, you'll never get done.
When you're typing "rm -rf" as root, you should immediately stop and triple-check what you're doing.
Cause either there's a safer way to do what you want to do, or what you're trying isn't a good idea in the first place.

(Even when you want to delete lots of stuff in root space, a better way is to use find. You can use it to look for and list the files you want to delete. After you've checked its output and verified that those are the correct files, just cursor-up to get the same find query again and add --delete at the end)

Can confirm. Accidentally did that a few weeks ago.