To me, this reads like an argument for a serverless architecture and not a discussion about VPCs themselves. But that's not always on the table. Even if a serverless architecture is better for some use case, if you have a traditional application that already works, it's inconceivable that setting up and monitoring the VPC is more effort than a massive rewrite to go serverless.