You are just exposing the application to the internet with extra steps in between

If the application is properly secured (strong encryption, strong authentication) there is no point for the VPN

and if the application isn't configured correctly, the vpn/internal network might not be configured correctly either.