It's sad that "zero trust" has become almost the opposite of what it originally meant. Now you can have the same insecure RDP server with admin/admin login but at least it's protected by a VPN that only a few tens of thousands of people have access to.