Comment by wglb

I once did an security assessment for a product such as what you describe. Among other problems with it, the product itself had SQL injection vulnerabilities

For another example of what defenders are up against, see https://users.ece.cmu.edu/~adrian/731-sp04/readings/Ptacek-N.... This paper all but caused an upheaval in the WAF industry.