Being able to roll it back isn't really a difference, you can revert to the previous version of a package too.

The trouble is if the WAF change e.g. messes up a redirect or turns a success response into an error response or vice versa, which confuses some other system into giving multiple users the same session cookie and gives them access to one another's accounts or writes corrupt entries to the database or whatever it is. You can revert the rule but that doesn't revert the state changes that have already happened.

There is inherently a trade off between keeping the system online, keeping the system patched and testing the patch before applying it.