Ideally they need to divide those apps entirely; your public website doesn't need to talk to your app.
For stuff like Netflix that is truly consumer-facing, where mTLS or IP whitelisting are non-starters, the reality is you have to rethink your model entirely.
Also, I'm not sure where you got the idea I'm talking about on-prem only; this also applies to using IaaS/ cloud hosted infra.
The reason we were talking about on-prem is because we're talking about the effort of doing these things yourself vs farming it out to a third party.
If you're a security engineer responsible for securing only:
1. a public website
2. stuff that can be ip whitelisted and/or use mTLS
Consider yourself very lucky. Most orgs need to expose a lot more than that.
loading story #50310792