If the web app firewall is part of the network I control, I still have to pay all costs associated with "bad" communication with it. If it's not part of the net

If the web app firewall is part of the network I control, I still have to pay all costs associated with "bad" communication with it. If it's not part of the network I control, then presumably I still have to pay something to use it, and moreover I can't trust it, so I have to duplicate all checks in my application anyway. (All this even if we grant the implausible claim that the web app firewall can reliably stop a useful set of attacks.) Where's the savings?