I would argue that making sure a VPN is correctly configured is easier than making sure every single backend service is configured correctly and patched against

I would argue that making sure a VPN is correctly configured is easier than making sure every single backend service is configured correctly and patched against all known vulnerabilities. Overall I think its best to keep those things on the company intranet and only accessible remotely via VPN, while further limiting the employee to have access only to the services they need on the network Even better though, why not use both 2fa and locking such improtant services to the intranet or behind a VPN