You mentioned your product is implemented in an older programming language dating to 1990. This suggests Python, Haskell or something more obscure (and if so likely worse).
The customer's security report has identified use of a Web Application Firewall in front of the application. One likely assumption many would make is that your application has a WAF because it is insecure without.
What does a WAF do? According to Wikipedia they monitor content and attempt to detect & block:
- SQL injection,
- cross-site scripting (XSS)
- file inclusion
- improper system configuration.
Wikipedia recommends against them saying "they also introduce a performance degradation and are easily bypassed by attackers."
You also answered, again in comments, that the WAF in question "In our case, it's a [very] small application that we maintain, audit, and build from source. It runs adjacent to our web application."
Now, if I was doing security diligence in a sector vulnerable to attacks:
Old/ insecure languages are going to put me right off. Haskell is a good language, I don't want a Python appserver, anything else is likely a total load of cobblers.
Having the WAF, and the generally understood purposes of a WAF, can easily feed into a perception that your underlying app & security may be very weak; and that you may be highly reliant on the WAF for security.
Many of the kind of things that Wikipedia suggests a WAF protects against -- such as SQL injection -- I would consider absolutely unacceptable to be in the core application. I would not accept these anti-patterns present anywhere whether an attempt had been made to mitigate them at other levels or not.
Perhaps the customer was willing to overlook security weakness of the core, if the WAF was solid. But what WAF are you using? Is independently known and reputable, something the customer can really trust in? Apparently not -- it's a small application you maintain and build yourself.
I'm presenting solely the critical view here so this will be negative, but ask yourself:
Would you, as a customer, trust a company with outdated technology, poor security and maybe using bad practices (SQL injections?) to maintain & build a security layer that needs to be 1000% secure?
Or would you instead prefer to choose a vendor with current technology (likely a memory-safe compiled language such as Java/Kotlin, C#, Rust, Go), good security and robust practices?
I am sure there is much we don't know, but perhaps this feedback could inform your company in regard of selecting & building a more secure technology architecture.