Is it not possible to set the lambda url has an origin in CloudFront and get WAF protection that way?

For all production workloads we typically have cloudfront in front of everything.