> It is my impression that modern companies that care about security assume that all networks are compromised and act accordingly. See https://cloud.google.com/beyondcorp as an example.

No, you assume the network can be compromised like any other device in the system. You still defend the network and add in layers of access control. Employees of Google still use VPNs to connect into sensitive networks.

With the prevalence of 0-days and demonstration of usage by nation-state actors, you have to have multiple layers of defense to try to have any reasonable chance of preventing a compromise.