Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes sense. What are the benefits of putting a WAF here? What are the risks if we don't do that?
Remember the CIA triad:
You appear to be focused on the Confidentiality part. A WAF can also protect public data from being modified, added to, deleted, or weaponised.
I can't tell you if that is a specific risk for you in this instance, but these are other concerns to consider even if the data is public.