Unknown or unforeseen attacks. The WAF ruleset can be updated much faster than code. WAFs also provide flexibility in how requests are responded to, or even disallow access from IP ranges, certain browsers, etc.

WAFs do throw false positives and do require adjustments OOTB for most sites, but you’re missing the forest by focusing on this single case.