I do agree with you that ModSecurity or similar WAFs are not a golden bullet.
But I know (at least?) one vulnerability that was found in RoR which affected Discourse that would have been mitigated by a ModSecurity-like mechanism.
When we were patching this we saw in our logs that it had been used in the wild on at least one of our forums before the CVE was publicly known and patched. This did not result in any information disclosure but that was only because we did some things differently from a standard install (i.e. luck).
I’m not sure if the added complexity outweighs the added security though.