Comment by bigfatkitten

> There's plenty of well-written explanations for why perimeter based security doesn't work

It certainly helps when your attack surface consists of numerous web apps of unknown quality.

Drive-by RCEs (e.g. log4j) then suddenly become much less of a headache when none of it is reachable by the world at large.

Exactly how you do that, whether via an authenticating reverse proxy or VPN doesn’t really matter.