I don’t currently understand the additional security from bastion hosts. Yes you can have them short lived. But if someone cracks the bastion it’s not very good

I don’t currently understand the additional security from bastion hosts. Yes you can have them short lived. But if someone cracks the bastion it’s not very good for security. I think it’s better with VPN plus SSM.