Comment by midtake

Zero trust is more like you need strong authentication like FIDO on the webapp even if it's behind the VPN, not that you get rid of defense in depth.