Your servers need a private network where you decide which parts the internet can reach. A VPC split into public and private subnets lets you put load balancers in public subnets and keep app servers and databases private, using a NAT Gateway when they need outbound access. A subnet is public only because of its route to an Internet Gateway, not because of its name. "Draw a VPC for a three-tier app" is a classic interview task.