Mike, I think you’re missing one point here or maybe you forgot to mention: network firewalls deal with a fixed pattern that is network protocols. I know what protocols/services can be of “interest” to a hacker and I can easily protect them. Firewalls usefulness certainly depends upon who writes the rules but they can’t be compared to WAF’s as they have to defend from different kind of threats. Web applications have some degree of uniqueness (you must know all of its parts if you don’t want to stick to a permit all). Attacks can be encoded. Some certain kind of attacks can’t even be detected (CSRF to name one).

So what security are WAF vendors giving? Andre Gironda has published a nice post about it today.
WAF surely can help if you find a vulnerability in the middle of the night as you say. But it shouldn’t be called security. It’s a misbelief being sold not real long-term security. Customers (companies) are not always educated to understand this difference.

Is there a market for VA+WAF – I’m sure there is – it addresses a need (or pain-point) that exists out there.

That market has a name. Three letters, starts with P and ends with I.

Keep the great job up, Mike