This is set at the profile level, yet you're looking at the individual threat protections.
You should look at the profile you're interested in.
Here's what I came up with:
mgmt_cli -r true --format json show threat-profile name "Optimized PhoneBoy" | jq '.overrides[] | {name: .protection, capture: .final["capture-packets"]} | select (.capture == "true")'
When you look at the different protections in a profile, there are three different settings: Original (what the protection is set to by default), Override (what the override says to do), and Final (what policy will ultimately apply).
Also note your dump of IPS protections likely only includes a limited number of protections (50) unless you called it multiple times with limit/offset.