The on-premise firewall does not work for ExpressRoute connection. The on-prem app server is open to the public internet through the Azure network. To protect the app server, Azure Firewall with policy rule sets is needed to filter all types of traffic, while WAF works only for web requests.
In short, the Azure network needs a firewall.
https://learn.microsoft.com/en-us/azure/app-service/environment/firewall-integration