With AWS, WAF unfortunately still incurs both the WAF request processing and the service pricing (such as Cloudfront or ALB), which means you still end up absorbing a large bill in case of an attack.

That'd be one distinct advantage of using Cloudflare over AWS, regardless of how opinionated it may appear; and you get to fine tune some of the settings if you're a paying customer.