Multiple URL's to a single VS with ASM

I do something similar (distribution via iRule), but assign the security policy to the VIP itself. However, our back-end pools all have the same security considerations so that works for us. If your differing pools have differing security considerations, then you would want to assign ASM profiles based upon those determinations (for example: Windows servers vs Linux servers would be a security profile consideration, or IIS vs Apache, etc).

This might help in that regard: https://devcentral.f5.com/questions/is-there-a-way-to-apply-a-different-asm-policy-with-irules-60073