This seems like a pretty good development overall - more people looking at application security across the org is a good thing imo especially if it can provide another layer of defence for where the app developers missed something or around new vulnerabilities just discovered. Even for things like Wordpress, I like the additional hardening of a WAF and with tools like OSSEC (and eventually more advanced tools like Immunio) on top of the usual app hardening.