A third of the web runs on Wordpress last I checked and that install base is largely maintained by small businesses who outsource that process to the least expensive option possible. If they do it at all.

A WAF is a good thing for most of that install base who have other things to do with their day to make sure they survive in this world than cybersecurity for their website.