> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security.

"Defense in depth" is not an anti-pattern. Using an VPN as the only layer is, certainly, but that is a straw man.