Worked for a major bank (think top 10). We had port knocking on several publicly accessible infrastructure pieces (LBs, some VMs, etc.)

Decades of running without a single intrusion. We moved to SPA port knocking and now we rely less on the VPN for certain assets.