[johntash]

Would you see using a vpn as the better alternative to a bastion host?

I've worked at a couple places where prod is air-gapped except for the bastion host that allows access to prod. But the bastion itself is still behind a vpn. And of course each user still has separate user accounts on both the bastion box and prod boxes.

I can definitely see your point though that a bastion/jumpbox isn't enough by itself.