But if you look at the recent hacks of auto companies, it was all driven by bad web apps, badly implemented SSO, bad REST APIs etc and they could get control of

But if you look at the recent hacks of auto companies, it was all driven by bad web apps, badly implemented SSO, bad REST APIs etc and they could get control of the cars because it was all public on the internet. A properly implemented VPN would have killed their ability to do those hacks dead. A VPN concentrates an encryption and auth system in one place, which is hopefully somewhat competent. The zero trust concept assumes every app is a web app, and every web app is secure enough to be exposed to anyone. Big assumptions to make.