VPN also have their attack surface: https://www.paloaltonetworks.com/cyberpedia/ivanti-VPN-vulnerability-what-you-need-to-know

Both can be true, a hardened service with strict segmentation and authorization can be harder to compromise than a loosely maintained VPN appliance.

Even when designing secure software, appliances and protocols, they can have their flaws.

I would say there is no definite answer for the question, it’s still on a case-by-case basis.