WAFs are literally "a pile of regexes can secure my insecure software"

But are they less shit than the shitty software they filter traffic for?