Most of the issue here is not features or limitations of VPN architecture, it's the decision to completely air-gap certain systems, which is a common practice i

Most of the issue here is not features or limitations of VPN architecture, it's the decision to completely air-gap certain systems, which is a common practice in both government and industry with critical systems. Just e.g. "doing BeyondCorp" does not address the problem that workers cannot interact with an air-gapped system without being in the special room in the special building.