> I thought everyone was doing that anyway prior to the "zero trust" thing.

Nope, lots and lots of organizations who have a zillion of internal services which they know to be insecure but are kept that way because they "are accessible only on the protected network".