The enterprise pattern is both, not either.
Direct Connect primary, VPN as automatic BGP failover — at a fraction of a second circuit's cost.
Site-to-Site VPNDirect Connect
Setup timeMinutes to hoursWeeks
BandwidthUp to a few Gbps50 Mbps – 100 Gbps
PathPublic internet (encrypted)Dedicated fiber
Direct Connect for performance, VPN as its BGP-based failover — cheaper than a second physical circuit, and the standard pattern this deck's scenarios reuse repeatedly.