WAF isn't natively supported by Lightsail at this stage.
The customer could however create a Cloudfront + WAF combination and use the Lightsail ALB DNS name as origin to make use of the security features offered by WAF. However, that would mean they have to create and maintain their own CloudFront Distribution, which may or may not work for your customer.
Lightsail with WAFAccepted Answerasked 2 years ago
Moving to Cloudfront from LightSail Distributionasked 3 months ago
How to use Lightsail load balancers globally instead of per region?asked a year ago
how to configure AWS cloudfront/distribution for plesk Ubuntu based wordpress website on lightsail instanceasked 5 months ago
AWS WAF & Shield w/Lightsail Instance? Possible and How?asked 2 years ago
Lightsail S3 Bucket behind Lightsail Distributionasked 7 months ago
LightSail as a managed service for hosting of 1000 WordPress sites?Accepted Answerasked 2 years ago
AWS lightsail Distribution (CDN) with C/panel
lightsail cdn default documentasked a year ago
AWS Lightsail Cdn