I heard back from their technical team:

> WP Engine Security and Engineering have enabled WAF rules for all customers using GES and AN. Mitigations are currently being deployed across the rest of our infrastructure, and official patches will be applied as soon as they become available.