Why can't network zones always follow the organisation's own physical cabling, so that perimeters need extending?

Because the parts that must be connected sit in places joined only by someone else's network: distant sites, mirrored data centres, home offices, outsourcing partners, remote maintenance, and distributed OT, IT or IoT devices.

Situations that need a connection beyond one's own cables:

• companies with many distributed, possibly far-apart sites;
• data centres deliberately spread over several sites and mirrored for redundancy (the further apart, the better for resilience, and the harder to connect);
• mobile work and home office, where users and devices can reach the company network only via the internet;
• remote access in outsourcing scenarios;
• remote maintenance, also in OT environments;
• data connections to distributed OT plants, other IT systems or IoT devices.

Dedicated leased lines such as dark fibre are rarely used, for cost reasons and because they often aren't available. Most connections run over a shared medium (a rented line) or a public network (internet, mobile network). The perimeter must therefore be extended across a network the organisation doesn't control.