Imagine watering a garden by filling a bucket with a firehose and from that bucket trying to redirect water to spray into smaller buckets that redirect to the plants.  Doesn’t it seem more efficient to run irrigation lines directly to the plants.  That is the difference between the traditional Firewall/VPN and the Zero-Trust model.  Zscaler secures the line directly to the application sources reducing overhead and increasing performance.   Removing the VPN concentrator also reduces the load on the internet circuit.  Why pay twice for what amounts to a u-turn sending the data back out the same circuit it came in on.  Zscaler maintains that protection but directly to its final destination.