It depends on your perspective.
If you are looking to it from the perspective of a website maintainer and caretaker, your two concerns are valid: HTTP/2 has been out less time than HTTP/1.1, and therefore software that speaks the protocol have had less time to mature. To the point, I would expect the combination of HTTP/2 and WAF is be a bumpy road at the moment. Also getting information and outsourcing security hardening for HTTP/2 is going to be more difficult than with HTTP/1.1. It should not be impossible though, judging by the amount of big sites (like this one) running HTTP/2.
On the other hand, if you are a web platform creator, are intimately familiar with HTTP/2 and happen to be the maintainer of your HTTP/2 edge
implementation, then HTTP/2 is slightly more enabling than HTTP/1.1 when it comes to security. For starters, a lot of malware and annoying bots are still running on HTTP/1.1, and that is a strong signal for the security stack. Also, multiplexing makes it easier to track and attribute user-agent behavior. HTTP/2's binary framing eliminates security issues caused by incompatible implementations of HTTP/1.1 chunked-encoding and pipelining.