It isn't exactly a straw man because it was often the default implementation. Yes, it was always a good practice to have the computers of the marketing team not have network access ( nor their user accounts LDAP/whatever access) to e.g. production servers, but not everybody deployed it like that, because it's hard, especially in big or acquired companies. There are environments where DHCP is disabled for "security" not to allow an attacker to get an IP in the network. For them obviously an IP is an "in", and they don't trust their defence in depth ( which of course, isn't a given).

In any case, Zero Trust fuses authn and authz and makes it so you no longer need firewall rules for protection. All of that now happens on the same layer, which makes it more accessible, accurate and easy to manage.

As for VPNs, the point is that they're of limited security utility, so they're just an extra hurdle for your own users. Yes, they "hide" your services from the generic internet, but those services should be hardened and protected in case of a breach of your VPN anyways, so the difference is minimal vs the effort and money spent on a VPN.

I feel like i should add a disclaimer that i work at a company who sell products around zero trust, among other things, so opinions my own, held before joining, etc.