I wonder if not having all the bot traffic hitting the application would create savings in resource requirements that would match or exceed the cost of the WAF.

I wonder if not having all the bot traffic hitting the application would create savings in resource requirements that would match or exceed the cost of the WAF. I.e. would it pay for its self if you had a lot of bot traffic.