When a site uses a CDN or cloud WAF, visitors reach the provider's addresses and the provider forwards traffic to your origin. As long as the origin address stays private, all traffic has to pass through the provider and its filters.
If an attacker learns the origin address, they can send requests straight to it and skip those protections. Origins are often found through old DNS records, certificate transparency logs, email headers, a forgotten subdomain, internet-wide scan data or a misconfigured server that reveals itself.
The fix is to make the address useless even when it is known. Configure the origin firewall to accept web traffic only from the provider's published ranges, or use authenticated origin pulls or a private tunnel, so that a request that did not come through the provider is refused. If the address has been exposed for a long time, moving to a new address is also worth considering.
Check from outside: if a request to your origin's IP works without going through the WAF, the WAF is optional for an attacker.