Zero trust is more like you need strong authentication like FIDO on the webapp even if it's behind the VPN, not that you get rid of defense in depth.