> But they'll probably check some box for some security audit so they're used.

A WAF is useful for when a zero-day is found for that legacy application you just can't get patches for anymore because the team has "moved on".