A WAF can block known _exploits_ it doesn't prevent the vulnerability from being abused by a new / other / slightly changed exploit.
Also a WAF isn't magical. I remember the whole 8KiB AWS WAF bypass thing.
You also just described system patching.
Also a WAF isn't magical. I remember the whole 8KiB AWS WAF bypass thing.