But what they mean by that was that the application (Gitlab in this case) should be behind a IAP proxy (https://docs.cloud.google.com/iap/docs) or something, not that you just put it on the public internet. Also defined here in the zero trust docs (https://docs.cloud.google.com/architecture/framework/securit...).

Zero trust is more like you need strong authentication like FIDO on the webapp even if it's behind the VPN, not that you get rid of defense in depth.

Zero trust ≠ publicly accessible.

And zero trust makes sense, once one service behind a VPN is compromised attackers can potentially move laterally, zero trust mitigates that

that works too

For personal services, even something as simple as HTTP basic auth on the webserver dramatically reduces the attack surface by blocking all probers and drive-by attacks.