Zero Trust security models often ignore physical threats. An attacker with building access can steal documents with sensitive data, walk out with a computer, or plant devices to intercept network traffic later. Most frameworks have no defense against these physical attacks.
Zero trust, to everything I have seen, does not take into consideration physical trust at all. But typically, you know, if you can get into an environment, you get into a corporate office, then there's very little to stop you from wheeling away the paper bin full of PHI, walking away with a computer that you can get into later, dropping something on the network to sniff all the connections or get remote access for later. I haven't seen anything to mitigate those or even take those into consideration.
