I'm don't follow. If you have a pre-auth reverse proxy in front of your web application, you drastically reduce your attack vector. An unauthenticated attacker

I'm don't follow. If you have a pre-auth reverse proxy in front of your web application, you drastically reduce your attack vector. An unauthenticated attacker can no longer simply rely on a vulnerability in the application or underlying framework, but must first obtain an employee's credentials, or find another vulnerability in the proxy or authentication infrastructure. This isn't a false sense of security. It is a concrete additional layer of security which has tangible benefits.