It's certainly possible to have a shared Threat Prevention layer that is included in each policy package.
The restriction about what gateway gets what policy is done at the policy package level.
That impacts both the Access Control and Threat Prevention policy install process.
Which effectively means: you will have to perform an explicit policy install for each gateway to update the Threat Prevention policy across all your gateways, even if the policy layer is identical across all your policy packages.