You can also do traditional VPNs ”the right way” - not granting access to resources just because user has a VPN connection, but configuring per-user/group access policies.
Something like Google's BeyondCorp where the access restrictions are done in a proxy or other application layer is much more likely to be tied to the same access controls used within applications. That way ZTA acts as an additional security boundary but not an entirely separate authentication and authorization system that VPNs tend to be.
I think when most think VPNs though they're talking enterprise ICT VPNs that historically don't play in that space :(
To need a VPN for "defense-in-depth" is to admit you don't have or want ZTA within parts of your perimeter. And that isn't a bad thing! ZTA is really hard to do unless you're building your business and all its core apps from scratch.