A VPC is still a network
A VPC or VNet gives an organization an isolated address space in a cloud provider. Subnets divide it into smaller broadcast and routing boundaries. Route tables, gateways and security controls decide how workloads communicate, just as they do on-premises.
Public and private are routing decisions
A public subnet normally has a route toward an internet gateway and resources that may have public reachability. A private subnet can use a NAT gateway for outbound access without accepting unsolicited inbound connections. The label alone does not create security; routes and policies do.
Security layers have different jobs
Security groups commonly filter traffic at a workload interface. Network ACLs or security lists apply at a subnet boundary. A firewall can enforce broader policy and inspection. Least privilege means allowing only the flows the workload needs, from the smallest sensible source range.
Hybrid links need both paths and policy
A site-to-site VPN or dedicated connection provides a path between on-premises and cloud networks, but both sides still need compatible routes, address ranges and security policy. Overlapping CIDRs make the path ambiguous and should be prevented during design.