The decision whether to try to avoid detection by default or to provide unique traffic signatures is a tricky one. In the long run, it becomes an arms race, where the attacker must always keep up with the defender or risk detection. Nmap has historically offered means of evading specific types of detection, but has not turned them on by default: packet fragmentation, source port spoofing, connection throttling, Idle/zombie scanning, etc. The capability is there, but the default is to be honest about what we are attempting to do.
NSE scripts have similar capabilities: you can slow them down with
--max-parallelism and related options. You can change the user agent string with the
http.useragent. You can send your traffic through a proxy with
--proxies. But by default, Nmap is very honest about being Nmap.
The trouble is that if any of these behaviors were made the default, they would cease to be stealthy. When Nmap was first written, its default TCP scan mode, half-open SYN scan, was the stealthiest thing around, because the TCP handshake was never finished, so there was nothing in the server's application logs about a closed connection. But as this scan mode became so much more popular, network IDS capability soon expanded to catch it, since the "SYN, SYN-ACK, RST" behavior is so very unusual and noticeable. But Nmap didn't change its default simply to avoid IDS. Instead, it kept the reliable method that had the least impact on ignorant systems—you might be surprised to know how many daemons will crash if you simply connect and hang up (
I've written a more thorough analysis of Nmap's defaults, how they can be detected, and how to change them to avoid detection. It's on my blog in a two-part article called "They see me scannin'". I have a feeling you would find it interesting.