List Event Receiver and Feature Scope

Recently my colleague created an event receiver which was going to be instantiated for all picture libraries at the site collection. He created a receiver and bound it like this:

<?xml version="1.0" encoding="utf-8"?>
<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
  <Receivers ListTemplateId="109">
      <Receiver>
        <Name>PictureLibraryEventReceiverItemUpdating</Name>
        <Type>ItemUpdating</Type>
        <Assembly>$SharePoint.Project.AssemblyFullName$</Assembly>
        <Class>Company.Features.PictureLibraryEventReceiver</Class>
        <SequenceNumber>10008</SequenceNumber>
      </Receiver>
      <Receiver>
        <Name>PictureLibraryEventReceiverItemDeleting</Name>
        <Type>ItemDeleting</Type>
        <Assembly>$SharePoint.Project.AssemblyFullName$</Assembly>
        <Class>Company.Features.PictureLibraryEventReceiver</Class>
        <SequenceNumber>10009</SequenceNumber>
      </Receiver>
  </Receivers>
  <Receivers ListTemplateId="851">
    <Receiver>
      <Name>PictureLibraryEventReceiverItemUpdating</Name>
      <Type>ItemUpdating</Type>
      <Assembly>$SharePoint.Project.AssemblyFullName$</Assembly>
      <Class>Company.Features.PictureLibraryEventReceiver</Class>
      <SequenceNumber>10010</SequenceNumber>
    </Receiver>
    <Receiver>
      <Name>PictureLibraryEventReceiverItemDeleting</Name>
      <Type>ItemDeleting</Type>
      <Assembly>$SharePoint.Project.AssemblyFullName$</Assembly>
      <Class>Company.Features.PictureLibraryEventReceiver</Class>
      <SequenceNumber>10011</SequenceNumber>
    </Receiver>
  </Receivers>
</Elements>

Unfortunately, it turned out that SharePoint (2010) added this receivers to all lists and libraries ignoring ListTemplateId parameter. I started investigating what's wrong and expected that my colleague made a mistake.

I noticed that feature scope is Site which is kind of logical since we're going to use this receiver in subsites as well. So, here starts an interesting part. I found out that MOSS 2010 uses following behavior:

1. If feature scope is site
1. If receiver scope is set to site = provision receiver to all lists of site collection (list template/url is not taken into consideration)!
2. If receiver scope is set to web = provision receiver to all lists of the particular web (list template/url is not taken into consideration)!
2. If feature scope is web
1. If list template and list url are not set = 1.1
2. List template = provision to all lists of correct type
3. List url = provision receiver to the particular list