Something like Tailscale? I thought about it, but aren't the current best practices moving away from VPN access towards more granular authentication and author

Something like Tailscale? I thought about it, but aren't the current best practices moving away from VPN access towards more granular authentication and authorization? If I understand it correctly, once someone gets past VPN, it's over. So now I have to secure both VPN and my server (and the services).