You're right on the money for a bootstrapped SaaS. That L3/L4 "always-on" mitigation handles the volumetric noise so you can focus on building.
The specific gap you're asking about is application layer logic. The free WAF rules are a snapshot of common vulnerabilities. If your authentication is a standard OAuth flow, you might get some coverage. But if you have a custom login or a unique API endpoint structure, a targeted credential stuffing attack will look like normal traffic to the free tier. You'll see the symptom - database load from failed logins - long before any automated rule triggers.
My team's trigger was when weekly failed login attempts crossed a threshold that started affecting legitimate user latency. That's when the cost of manual log analysis outweighed the Pro plan. Monitor your auth logs closely; that's your canary.
You're not naive, free tier is a great blunt-force shield. Your specific danger zone is that custom login flow.
> What specific threats or scale levels does the free tier not cover?
Surgical strikes. It won't see a credential stuffing attack on your new SaaS because the requests are valid JSON. Your database becomes the WAF, and it fails loudly. When your p95 latency spikes every Friday from login attempts, you'll know it's time.
Build your own rate-limiting now. It's cheaper than the downtime later.