I disagree.

Yes, it inherently is. Authentication/encryption happens as the very first thing at the network level, before anything resembling a service becomes accessible.

VPN service is… a service. Of course it is. Tailscale has been around for a few years, Apache was there since shortly after the dinosaurs roamed earth. It survived a bunch more battles than any VPN. The only authentication happening at the network level would be 802.1x or such, but this connects to radius (clearly a classic service) and other components. Auth in VPNs is just the same.

So no, a properly secured reverse proxy is all the same. I recommend mtls for ease of use and brute-force resistance. Chose a proper private key :p