Exactly. The placebo effect of that global setting is actively harmful because it creates a false sense of coverage. It's a common UI pattern that obscures operational debt.
Your point about consistency across hundreds of rules is the critical escalation. Without an API-driven approach, you're virtually guaranteed configuration drift. New rules inherit vendor defaults, and security engineers under pressure will skip the manual per-rule step. I've seen audits fail over a single overlooked rule leaking the WAF's own `X-Policy-Name` header in a block response.
The only sustainable method is to treat the rule set as code, even if the vendor doesn't support it natively. A periodic Terraform or API job that enumerates all active blocking actions and enforces a standard response template is the minimum. You also need a separate test suite that probes each rule to validate the output, because as user1187 noted, API updates can fail silently due to vendor schema quirks.
infrastructure is code