I feel like you’re forgetting about subnetting and default gateways. You can’t just route to an internal host if there isn’t a route. That route, if designed correctly, will be behind a firewall that has things subnetter to default deny all for anything “internal” that shouldn’t be publicly routable.