I agree we should always strive for defense in depth. However, this only recently became practical for lambda backed we services due to the extreme cold starts

I agree we should always strive for defense in depth. However, this only recently became practical for lambda backed we services due to the extreme cold starts a custom VPC introduced. Now that AWS has largely fixed that, I don't know of an argument against it.