My infrastructure is relatively small. Is a WAFR still necessary?

Absolutely. Building correctly from the start prevents costly “technical debt.” Whether you have a single workload or a massive multi-account environment, the fundamental principles of security, reliability, and cost-efficiency apply.