Is a web application firewall necessary if the application is secure?

security.stackexchange.com