What is the important caveat about gateways in a security architecture?

Gateways are not security solutions per se. To a first approximation they are open connection points with various conversion options for incoming or outgoing connections. Every gateway must be checked for its suitability in the target scenario, it almost always needs additional protective measures, and upstream security components are often recommended.

This is the thread through the whole topic. An email gateway, a web proxy, a data or API gateway each exists to let something through. Whether it also stops the bad part depends on its features, its configuration and its operation. So a design that lists "gateway" must also say what the gateway checks, what protects the gateway itself (it is an attractive, exposed target), and who maintains it.

Go deeper:

• Web application firewall — Wikipedia — the extra security component often placed in front of gateways.
• Attack surface — Wikipedia — why every extra passage and legacy part enlarges what can be attacked.