ESP / tunnel mode is often used when you want to connect two different POPs' networks together: you're basically implementing a full network and routing layer on top of an encryption layer, and the networks have zero knowledge that they crossed a public network (like the internet). When you simply want to encrypt everything between two endpoints without a routing layer (usually when those two endpoints want to talk to each other, but not networks behind them) it's burdensome to create an additional routing layer.
Transport mode is used all the time between two endpoints when a full tunnel with separate routing and networking is not required. This is somewhat analogous to when you create an TLS connection between your computer and a website; you don't care that someone can see traffic between the two of you, but you do want it encrypted.
Transport mode is roughly the equivalent of a TLS connection to your bank's website, while tunnel mode is roughly the equivalent of using a VPN client to connect to your employer's internal network. There are exceptions, of course, but that's the general gist of it.
Example: say you have two machines with public IPs and you want them to make RPC calls to each other. You obviously don't want them to communicate over the internet with no encryption or authentication. You could do it via TLS (layer 7), but you may as well do it via IPsec transport (layer 4), as that removes the burden of encryption on any software you're using; this is especially important if that software has no understanding of TLS at all. With transport mode everything between the two machines is encrypted, from ping requests to telnet to any random traffic you open between the two.
Now you COULD do this over an ESP tunnel, but 1) this requires all your software to be aware of the new routing endpoints, IPs, and gateways, rather than the public IPs that already exist and 2) it's less efficient, as now you have the encrypted traffic plus additional tunnel-wrap overhead.
As for AH, I've rarely seen it implemented, as its primary purpose is to verify any payloads arrive unchanged from the source. The situations where you care about verification but not encryption are fairly small and often better served with full encryption anyway, but theoretical places where it would be used would include things like anti-virus/malware being injected by third parties in transit but where full encryption might be too costly for the hardware on hand. Again, these are very niche applications.