From my experience corporate VPNs exist to allow employees to access internal resources remotely. They aren't typically used for security although they can provide some form of security for remote workers.
VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine, not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often they lure IT environments into a false sense of security.
VPN's are the enabler that ensures status quo remains.
VPNs handle network security, but don't protect you against an attacker able to compromise an endpoint in your corporate environment.
When you control¹ all the devices on the network, the network is small enough and the danger from the non-authenticated protocols isn't too high, then I would say it is reasonable to assume being present in the network is sufficient authentication. Not saying it could not be improved, but there are probably many more pressing concerns.
¹ you don't fully control anything anymore, but you're not going to fix that either.
That's one of the issues though. If you can't access a machine via its internal IP, many useful usage patterns break.
Someone complained that the issue is that services aren't secure, but there's more to it than that: good security depends on defense in depth, and firewalls are an important part of that.