Note that there is still the concept of "inner trusted zones" with something like BeyondCorp, the difference being that access to the zones is controlled by cre

Note that there is still the concept of "inner trusted zones" with something like BeyondCorp, the difference being that access to the zones is controlled by credential via an Access Proxy rather than by network topology. Of note, individual servers do NOT need to be individually fully defended, they are protected by a firewall which only allows the Access Proxy.