Piracy: ꜱᴀɪʟ ᴛʜᴇ ʜɪɢʜ ꜱᴇᴀꜱ

If a service is publicly accessible, anyone can access it.

false.

Even if it’s secured, there can be security issues in the auth layer of the app, improperly secured endpoints, etc.

true, fun fact a VPN is also an application with an auth layer. dun dun dun!

If a service is only available over VPN, nobody can access it unless they’re on the VPN.

which is basically anyone soon as a browser is in the mix. which it is.

I’m not sure why you seem to think that a private network isn’t more secure than a public network.

because I've done network hardening and know that they are only as secure as the devices and people that are a part of that network. it has nothing to do w/ private vs public and everything to do with what you do while within that network.

There’s a reason why practically every company requires people working remotely to connect to a VPN to access company resources.

uh huh. heard of lemmings? appeals to authority? etc, etc, etc. thats you right now. federal agencies guidelines regarding VPNs search terms for you: Federal Zero Trust Strategy (notably via OMB Memo M-22-09). Individuals like yourself are literally the reason they had to release these updated guidelines. because people kept quoting out of date security practices from their old guidelines as 'good enough for the feds must be best practices'

like i said you dont know what you're talking about. historical foot note: when the federal agency updated their recommendations regarding VPNs they were criticized by security experts for taking so fucking long to finally remove the misguided position that VPNs improve security that you hold.

here is a relevant snippet for everyone:

Regardless of the approach selected, agencies must move away from the practice of maintaining a broad enterprise-wide network that allows enhanced visibility or access to many distinct applications and enterprise functions. Accordingly, agencies should choose their zero trust approach early enough to permit them to align that approach with their plans for IT investment

Literally use 'authn/authz' and dont rely on VPNs for ACL. Here is another gem from that memo for today's lucky 10,000:

Agencies must remove password policies that require special characters and regular password rotation from all systems

and yet companies still put that nonsense into their security policies.