They have rate limiting rules but they aren't on by default and are separate from the WAF which is mostly stateless.