When are manually written WAF rules still worth the effort?

Only in exceptional cases, typically to provisionally protect a specific, known vulnerability until a patch for the application is available.

Writing and maintaining rules by hand cannot keep pace with the size and variety of modern web presences, so it is not a way to run a WAF. It is a precise tool for a gap in time: a vulnerability in the application is known (for example, one parameter of one page is injectable), the fix will take days or weeks, and in the meantime a hand-written rule blocks exactly the requests that would exploit it. This is commonly called virtual patching. Once the real patch is deployed, the rule should be removed, or it becomes one more undocumented special case to maintain.

Go deeper:

• OWASP Virtual Patching Cheat Sheet — how to write a temporary WAF rule for a known vulnerability.
• OWASP — Virtual Patching Best Practices — when a virtual patch is appropriate and how to retire it.