I didn't say forgo the VPN. That would be unnecessarily increasing your attack service. In fact I specifically mentioned doing whatever you can to increase isolation between workloads, this includes ensuring access between dev, support and production machines is either not possible or is via careful controlled and audited means.

I only said bastion hosts are bad and generally decrease overall security because it's almost impossible to craft one that doesn't create more security holes than it closes.