I mean, yeah; agents and AI training data spiders basically operate like DDoS swarms, and it's not like their harnesses implement client-side rate limiting or anything like that. WAFs were designed to block/slow exactly this kind of traffic, so make sense that businesses will use them as designed.