Using VPN as a layer of security is basically like 2FA, where the second factor are credentials to enter the VPN. Wouldn't it be easier to just have any other additional factor, like a physical security key, or some (additional) authenticator mobile app?
Entering a VPN is usually multi factor by default, because you need both a certificate and a login. Also, there's often a token as a third factor. So you're adding many more levels of security that way.
