I'm moving this over to the NPM forum but feel free to create an idea in the Network Performance Monitor Feature Requests forum to have others vote on your feature request.
The pre-written piece is keyed to the TYPE of alert (node, volume, component, etc). It's the pieces that SolarWinds *must* have in order for the alert to work at all. They are the basic items like NodeID, statistic value, etc.
Were they (SolarWinds) to allow you to do a completely free-form SQL query, I'm sure the very next post would be "why doesn't my alert actually work" followed in short order by "Why can't you hard-code the fields I must have for an alert to work into my custom alert SQL query?"