I think the main point is the WAF companies must have lobbied to get that into the checklist

the main point is you need to pay a third party

You can call your existing reverse proxy a WAF to check this checklist item. (Your point still stands, on the median companies may opt to purchase a WAF for various reasons.)