That would only be true if WAFs weren't so easily bypassed: https://habr.com/en/companies/dsec/articles/454592/