Ask HN: Is IP whitelisting still “a thing”, and why?

In the quest to get up to speed on latest trends, I was very surprised to find an organization asking for a well developed (assumed maintainable and scalable) IP whitelisting process, when just a little while ago, when I took my sabbatical, we were way into either: - WAF/UTM to protect everything public facing (who could possibly certify consistency and maintainability of source IPs?) and/or - JSON produced sets of IPs, from large service provider, "installed" on edge devices (FWs) and/or - FQDNs, with verifiable name résolution, where no other solution was possible, to still narrow down sources, and no longer IPs. Is anyone still using IP whitelisting? Why? And how do you lifecycle such (MACDs)?