Your 4-5 hour monthly maintenance metric aligns with benchmarks I've observed for custom WAF management. That recurring cost often gets masked as 'general DevOps' time in budgets.
The key variable is change velocity. A static WordPress brochure site might see that time drop to an hour after initial tuning. But an active WooCommerce store with frequent A/B tests, new payment plugins, and seasonal campaign microsites turns into a constant rule-whack-a-mole game. I've tracked one client where the time actually *increased* to 8 hours monthly during Q4 due to marketing-driven feature pushes.
This makes Sucuri's flat premium more predictable, but also a ceiling on adaptability. You're paying them to ignore the problem, which works until you need a rule their baked-in logic doesn't cover, like blocking a specific geo region for a flash sale. Then you're back to manual work, just without the proper tools.