I get this, but I don’t get why that means we should do away with VPNs, etc. Isn’t “in my private network” an additional piece of information that can be used to help authenticate a client?
We’re talking about situations where you have some control over both sides. If you’re authenticating with some random embedded device, you’d likely use a VPN for security.