I've thought for a long time that this is a broader problem with the whole firewalls-and-NAT network security paradigm. It leads to a "soft underbelly problem" and a complacency that leads to insecure internal systems.
From what I've seen: God help most organizations if someone gets to the internal LAN!
The rule should be: If your thing can't run securely on the unfiltered Internet, it's broken. Any firewalling and such should be a defense-in-depth afterthought.
Of course this is kind of perfect world thinking. The reality is that quite a lot of software is either broken or insecure by design (e.g. databases that assume a secure LAN and don't even authenticate nodes) and so in practice we're quite far from this being practical for all but the most carefully managed deployments. Developers are also notoriously lazy about security while developing. I'm as guilty of this as the next dev sometimes.
I think the latter part of this is too pessimistic - network segmentation works as long as it's fine grained. Put that kind of apps on their own isolated vlan/vpc/equivalent and put an authenticating ssl proxy or something as the gateway.
That was also very bad, but this now is even much more obviously worse.
The common is, both are by the same company NASDAQ: FTNT, with almost 2B revenue which, as stated officially, provides "top-rated network and content security, as well as secure access products that share intelligence and work together to form a cooperative fabric"
Though the main harm of VPNs IMO is that they lead to "the secure company-internal network" style thinking.