Imunify360 provides excellent value for money, in my opinion.
However, CSF & a good (read: good - not all of them are, some provide outdated rules that just don't cover recent exploits) mod_security ruleset will go a long way towards keeping things secure.
I think it also depends on the environment. If I were running a server just for my own sites, I'd be quite happy to run without Imunify360, CSF, mod_security, etc - simply because I'd have more trust hosting only content that I uploaded.