I don't see issues with WAF. Sure, it takes some time to set up so that you have <0.01% false positives but it filters out tons of robot attacks and other garba

I don't see issues with WAF. Sure, it takes some time to set up so that you have <0.01% false positives but it filters out tons of robot attacks and other garbage. As backend does not have to deal with it, things like server errors almost vanished and I think it's a good tool - just like having a firewall. Of course you should not overdo it with the rules and check the logs once in a while (just like with SIEM). I do however have issues stupid CAPTCHAs like Cloudflare has that even humans can't pass through when using a privacy oriented browser. Sites should serve visitors and not the other way around.