The usual argument for using a FW is it's a device built for security, and is "better" for any publicly connected interface. Of course, a FW adds cost and sometimes creates a throughput bottleneck.
Personally, I don't believe a FW is warranted in front of a VPN router, because, as you note, you can lock down the publicly connected interface.
Interestingly, I've seen Enterprises have a FW in front of their VPN hub router but not have a FW in front of each branch VPN router. Since a VPN branch router also provides a path into the Enterprise, I've never heard a good explanation why a FW is a "must" at the hub but not also at the branch.
BTW, the company I'm working for does have VPN hub routers with direct Internet connections.
Also BTW, if you want to further harden a VPN connected router, you can also place its publicly connected interface into its own VRF. This means unless the traffic comes through a VPN tunnel, you can preclude it from routing internally.
