Still have plenty of services with network trust everywhere I've worked, particularly in the oldest and slowest moving parts of an organization, but now I'm on

Still have plenty of services with network trust everywhere I've worked, particularly in the oldest and slowest moving parts of an organization, but now I'm on VPN instead of LAN. I can still ping AD and SAP and whatever else one could find if you could run nmap on your work network. It's not really about trusting more or less outside networks, it's about exposing your network very selectively (e.g. single services behind authenticating proxies), preferably with a corporate login and some form of device attestation.