Am I the only one who thinks this feels wrong? Shouldnt cloud services use token based auth even internally?

At our place we don't protect our backend services behind firewalls, they're protected by auth0 tokens ...