My experience has been that version rules operate as Dmitri explains.
So, my Flash player rollout job has an Applicability Rule:
AND
NOT
File Version
File path: c:\...\FlashPlayerUpdateService.exe
Version type: File Version
Version must be > 11.2.202.235
So on PCs with older Flash players it's applicable but on my new image test PC with 11.4.402.265 it comes up as not applicable because it evaluates 11.4.402.265 as greater than 11.2.202.235, i.e. True.