[rcxdude]

They may mitigate known proofs of concept of vulnerabilities, and require a small amount of creativity to work around. At the cost of randomly breaking things.

[cluckindan]

That creativity takes time. WAFs are the first line of defence, buying some time for fixing the actual vulnerabilities.