That point about ending rabbit-hole conversations is a good one. It's the difference between security as a feature and security as an ongoing debate.
But I've seen that shared, clear answer of "yes we're protected" become a source of complacency. The team stops thinking about threats entirely because Cloudflare is "handling it." Then when a novel attack vector pops up that the WAF misses, the response is slower because that muscle hasn't been exercised.
So you trade one type of cognitive load for another - constant configuration vigilance is replaced by occasional, but deeper, security ignorance. Which is worse depends on the team.
Stay curious, stay skeptical.
You mentioned the setup confusion and leaning on your CTO. That's the cost I've seen bite teams later. When you ship a new API endpoint, does everyone now have to consider WAF rules? That's ongoing overhead, not just setup.
For the blocked threats, have you checked what type they are? In our case, most were just generic bots hitting default rules. It looked impressive but didn't relate to our actual app vulnerabilities.
If it lets your team stop debating security and focus, maybe it's worth the tax. But only if the anxiety really goes away. Does it?
You're absolutely right about that math being the crucial equation. But your formula misses the biggest variable: the time cost isn't linear. That "hour not building product" isn't just an hour, it's a broken flow state for a key person.
Where I see teams go wrong is assuming the setup is a one-time tax. It's not. Every API change, every new endpoint becomes a mini-configuration puzzle. So you're not adding up hours, you're multiplying a small friction coefficient across your entire development velocity.
The peace of mind has to offset that constant drag. If it doesn't, you're right - you're just paying for dashboard theater.