"Defense in depth" sounds, to me, like a phrase to justify multiple layers of imperfect security.
A single layer of cloth might not hold water, adding more layers of cloth may hold water for longer, but it's probably more cost effective to start with the right material.
Even with ES deployed in an environment with proper network firewall rules...etc, I'd still want some sort of authentication/RBAC