Earlier quoted context omitted.
WAFs are literally "a pile of regexes can secure my insecure software"
They do mitigate known vulnerabilities.
They may mitigate known proofs of concept of vulnerabilities, and require a small amount of creativity to work around. At the cost of randomly breaking things.