Thos doesn't pan out in practice. One the VPN is there, people get lazu & complacent about implementing strong security inside.

Defense in depth is a concept that should be applied with some thought, it would be good if your additional layer did something different. For example good reactive security, endpoint attestation, etc.