It's basically fizzbuzz. If you have a WAF, it proves you know how to add a WAF. Presumably even one you know how to configure when security needs change.
Compliance auditors are mostly there to underwrite posture, not actual risk.
Compliance auditors are mostly there to underwrite posture, not actual risk.
Just as financial auditors are only confirming that your financial statements match what your accounting department tells them.
If you lie to your auditors, there's a good chance they won't catch it because that's not what they are looking for.
There's no audit checkbox for "WAF actually does something useful", so it's fine.