> Internal networks only accessible via VPN is considered an anti-pattern now in terms of security. It puts authorization firmly on the VPN.

How do you jump from "VPN is not authorization" to "VPN is an anti-patern"? It's at a completely different layer than authorization ffs! You don't give up on seat-belts because they don't stop bullets coming through the windshield.