If the proxy gets compromised it will have access to the services whether it’s in a DMZ or VLAN or whatever. I’m unclear on what scenario you are trying to prevent or mitigate.
If the proxy has a remote exploit and it’s publicly exposed you’re screwed anyway.
Put it behind an encrypted authenticated tunnel if you’re worried about this i.e. not publicly exposed. Or expose it and keep up with the security fixes.
Also not sure what you mean when you say your current proxy is a “bouncer” and that it “could” expose your services if something goes wrong. Isn’t that its job, to expose them? Is it doing any authentication right now?