twest 100% on this, I too have been using it as part of my go to stack for nearly a decade myself.
Andreas When I have all the other layers of protection in place from CloudFlare down to server mod_sec rules etc... (WHM + CL + OSWASP Etc...) I still had a high value website take 1.8 million attacks per month, all blocked and reported by WordFence. So if the server level and edge network WAF's did there job, why would the last line of defense WordPress WAF block so much?! (It's doing it's job) enabling premium on that site showed that 90% of the attacks where coming from unknown IPs and not on their main real-time black list. Up to that point of trying premium free tier had been fine for 6 years and likely would continue to be fine.
I've tried a few other solutions and personally not liked them, Scurri might be a true contender I've not really tried that one much. I also have no need to switch since I am 100% happy with the results of Wordfence. It's never been an issue at anytime. (for me) I ignore the messages saying increased attacks etc... I am not stupid to marking hype free tier is good enough 99% of the time.
I've only have 1 website that has the paid sub, the rest 50+ are on free tier and been fine for as long as I can remember.
The only website that got hacked with it on, wasn't the WAF it was the 3rd party hosting supplier! I immediately redirected the traffic to my enhance estate with a backup copy I'd taken a couple weeks before. No issues, eventually sorted the copy out on the 3rd party a few days later, cloning my version to it, reset the DNS records to them and it was hacked within 24 hours again. (exactly same code base) I immediately took DNS back to my enhance server and there its remained so far for 18 months hack free. I will say this the 3rd party cpanel server was so over loaded that WordFence couldn't even daily or on-demand scan without failing. I would never trust or recommend that hosting to anyone... (won't mention names but there well known, running a typical cpanel setup)
So I do sleep well at night knowing it's at least 1 more layer in the onion of security and I sure as heck would't knowing there wasn't a final WAF at the WordPress (Actual Application) level installed, by at least 1 major security vendor. bitninja and all these others are minor players I doubt they'd have the same level of security, certainly not the funding, resources or R&D that Wordfence has. (There's a good reason Photoshop has the monopoly and GIMP is an after thought, Affinity Photo is just a cheap alternative by again a well funded org)
As they say each to their own, but I have very valid and legitimate cases for it being installed in my stack and that is unlikely to change anytime soon. No solution is infallible or 100% safe. But having thawed 10's millions of attacks for me its good enough.
