Shouldn’t rely on for sure, but I think for many running legacy software employing a WAF is not unwise, as long as it is configured in such a way that it does not break anything, and it’s not being treated as a way to not fix security problems. At the very least, it can potentially hold back low-skill attacks before patches are rolled out.