All of the assigned capabilities of executables are likely to be actually needed unlike those of dlls, so it makes little sense to allow patching of application capabilities with patch_capabilities.pl script. Also, if application has protected range SID, there is no point in making a patched package, as self-signed certificate will not be enough to install that package.