That’s security hand wavy drama. By that standard why set a password, they are all crackable after all! The reality is that most attacks are automated kits or similar stuff that WAF combined with other controls can help with. It’s risk mitigation.

At the end of the day, the red team always wins. Tactical risk mitigation, segmentation and logging are the way to address security. Best case, your monitoring detects and alerts on the guy attacking the WAF, otherwise you have logs to conduct an investigation later.