Why was simple perimeter security found insufficient, and which improvements make up enhanced perimeter security?

It has no answer to remote work, and even simple scenarios need data exchange with third parties (e.g. email) that opens uncontrolled holes. The improvements: extending the perimeter with VPNs, controlling crossings with gateways, application-level firewalls, alarm systems, a proper rule set, and DMZs.

• Extended perimeter: VPN. Brings remote users and remote sites inside the boundary.
• Better perimeter control: gateways. Email gateway, web proxy, data gateways with content control, API gateways, reverse proxy, application gateway. Instead of just opening a port, a gateway checks the content of what crosses.
• Application-level firewall. Understands the application protocol, not just addresses and ports.
• Alarm systems, a maintained rule set, and a DMZ for systems that must face outside.

The idea in each case is that the holes the business needs are not left as plain open ports but placed under control.