The vast majority of WAF deployments seem to be plain defense rather than defense in depth. I.e. WAFs aren't very often deployed because someone wanted an addit

The vast majority of WAF deployments seem to be plain defense rather than defense in depth. I.e. WAFs aren't very often deployed because someone wanted an additional layer of protection on top of an already well secured system. Typically they're deployed because nobody can/will add or maintain a sensible level of security to the actual application and reverse proxy itself so the WAF gets thrown in to band-aid that. Additionally, a significant number of enterprise WAFs are deployed just minimally enough to check an auditing/compliance checkbox rather than to solve noted actionable security concerns. As a result, they live up to the quality of implementation they were given.