I'm don't follow. If you have a pre-auth reverse proxy in front of your web application, you drastically reduce your attack vector.

An unauthenticated attacker can no longer simply rely on a vulnerability in the application or underlying framework, but must first obtain an employee's credentials, or find another vulnerability in the proxy or authentication infrastructure.

This isn't a false sense of security. It is a concrete additional layer of security which has tangible benefits.