The "free" part of Shield Standard is a bit misleading. It comes with the bill, but you're paying for it with every AWS data transfer charge you incur. It's not a separate SKU, but it's not magic either. The protection is real, but the cost is just baked into the infrastructure.
Your stack is too complicated.
Your building storm drain analogy is a solid one for beginners to visualize the distinct layers. It helps avoid the common misconception that a free, automatic tool like Shield Standard can replace a configured control like a WAF.
The analogy's strength is in showing they aren't redundant but complementary. A storm drain is useless for checking intent, and a security guard can't handle a flood. However, one nuance often missed is that the "building" itself has several entrances. Shield Standard protects the network layer entrances to your AWS resources automatically. A WAF, however, only guards the specific application-level doors you place it in front of, like your CloudFront distribution or Application Load Balancer. If you have other entry points, say a public EC2 instance with an Elastic IP, Shield Standard is still active there, but a WAF isn't involved unless you architect it to be.
So the "need both" answer is correct, but with an important architectural caveat: you need to ensure your WAF coverage aligns with your application's attack surface.