The web browser doesn’t care if the application is behind one, two or three rproxies. If I can still get to your application and guess your password or exploit a known vulnerability in your application then it’s game over.
Right!?
Your castle can have many walls of protection but if you leave the doors/ports open, people/traffic just passes through.