Why does putting an API Gateway in front of internal microservices matter for security, not just routing?

Internal services sit behind the Gateway and are never directly internet-reachable — a compromised or misconfigured internal service is one full network hop further from being publicly exploitable than if every service were independently exposed.