I liken WAFs to signature-based virus scanners which IMO are not very useful in environments with a limited attack surface (e.g. your non-Windows servers)
They’re not going to catch everything but they will (in theory) catch common patterns of attacks (e.g. SQLI) and known exploits (e.g. the RoR vuln above) across a range of software.
I can see the value of running them especially in an environment (enterprise) where you have a ton of applications running god-knows-what and you need to know you’re protecting each application from these exploits without needing to worry about every individual one - that takes an NxM size problem and reduces it to N+M
Whether or not it’s worth running on your site is a different matter and one of those risk (of breakage)-benefit (of protection) analyses you’ll need to do for yourself.