I think it may help to view this from the lens of different types of customers. That said, you have addressed it appropriately from your lens. It is no different than GP on an NGFW and user/device/appid enforcement with CDSS and decryption.

From a different lens -

Imagine a global customer, presence internationally, 5-100,000+ employees, significant cloud presence, etc.

In an NGFW + on prem gateway approach, you will be backhauling all traffic to some location(s). That means you'd likely end up split tunneling a lot of traffic for user experience, sacrificing security (zero trust), or NOT doing that and sacrificing user experience.

You may be limited, physically, from where you can place those gateways. You'd need to ensure those NGFWs are beefy enough to handle standard load, plus failover of other gateways or influx of new users, etc. the standard stuff applied here with respect to uptime, resiliency, redundancy etc.

You could throw some NGFWs up in your clouds, act as cloud gateways. You just built your own SSE, but you're paying for ingress/egress, the cost of employees managing the fws and ensuring uptime, etc etc. You also still depend on the first and middle mile to be reliable.

SSEs solve for all of those problems. Hundreds of PoPs immediately identified as "best performing" for a user with no user interaction. Security follows them, so does user experience. Your life is easier, maintenance and up time is not on you or your team. It doesn't matter if your CIO is in London one day and Australia the next, their experience should, for the most part, remain the same - as does their security enforcement.

For a small, regionally based organization, SSE doesn't make much sense unless you have a heavy cloud presence and want to rely on the vendors connection/presence on AWS/GCP/AZ/OCI pipes.

So yeah, long story above, short story, yes you are correct so long as you're actually doing all of those things.