I cannot upvote this hard enough.

I see this all the time with VPNs. By having everything behind the company VPN, application security isn't taken as seriously. As a result, lateral access becomes trivial at these companies.

Keeping everything public internet exposed from the start actually results in better security.