I would think of BeyondCorp as end users accessing services through an application-layer perimeter from a public network, instead of directly from a private net

I would think of BeyondCorp as end users accessing services through an application-layer perimeter from a public network, instead of directly from a private network. The network where the services actually sit becomes, in effect, even more private.