That's actually anti-ZT practice, which clearly requires that you put maximum security controls you can to protect every resource. especially do not assume trus

That's actually anti-ZT practice, which clearly requires that you put maximum security controls you can to protect every resource. especially do not assume trust based on network location/perimeter, is very first tenet. But yeah, security in many orgs (regardless of the size), is another item to be ticked, and thus a false sense of security prevails until an incident happens. Eventually, only such orgs will survive and thrive which will be able to defend their resources, in the increasingly hostile online environment with state-backed attackers. Whether this defense comes from individual organizations or their state, or a combination of both, that's something to be seen in the next 5 to 10 years.