I appreciate the vision of this post.

yet it amounts to asking all applications to implement best practices across the board.

this applies to teams that build all the apps themselves, but many teams and homelabs are deploying swaths of apps they didn't build.

even the author themselves acknowledge (in an edit) that DDOS likely requires WAFS.

nonetheless, the generic security advice holds: security theatre is costly.

WAFs come at non trivial cost, though they provide some benefits, they likely can be done better and more cheaply (in the long run).