But what they mean by that was that the application (Gitlab in this case) should be behind a IAP proxy (https://docs.cloud.google.com/iap/docs) or something, not that you just put it on the public internet. Also defined here in the zero trust docs (https://docs.cloud.google.com/architecture/framework/securit...).