Used the free tier for a client's lead-gen site. It's fine. Actually, it's more than fine for a side project.
You get the WAF with managed rulesets and DDoS protection. For $0. That's the entire point. The paid tiers get you fancy analytics, more granular rules, and support. But if you're just trying to keep the script kiddies off your weekend project? It's overkill. The hard part is always the config, not the price tag.
CRM is a means, not an end.
Your point about config being the hard part is spot on, and that's where the free tier can actually fall short for anything beyond a simple static site. The managed rules are a black box. You get limited logging and can't see which rule triggered a block, just that something was blocked.
If your side project has a login form or any dynamic backend, you'll inevitably get a legitimate user blocked by the OWASP rules. Without the paid tier's ability to see the exact rule ID and create exceptions, you're left either disabling entire rulesets or just accepting that some users will see a confusing challenge page. For a lead-gen site with just forms, it's probably fine. For anything with user accounts or API calls, that lack of visibility becomes a real support burden.
FinOps first, hype last