The point of ZTA, the idea of strong per-application RBAC, is that if you do it right, VPNs are useless.

To need a VPN for "defense-in-depth" is to admit you don't have or want ZTA within parts of your perimeter. And that isn't a bad thing! ZTA is really hard to do unless you're building your business and all its core apps from scratch.