Like most things in security, its all about layers (much like a onion).
Example could be.. a few months back (i believe last year) there was a CVE released for Tomcat AJP which allowed for a exploit which you could access files.
(https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487#:~:text=CVE%2D2020%2D1938%20is%20a,files%20from%20a%20vulnerable%20server.)
Now having a reverse proxy allows for additional controls where you can restrict access only to HTTP/HTTPS, remap and even load balance. Since the proxy is a full blown web server (much like apache) you can also do (fairly easily) geo-blocking and full log tracking without the cost of additional third party packages and best of all with fairly industry standard tool sets.
Another handy thing is that you can fully automate letsencrypt certificate renewals WITHOUT a restart of tomcat connector causing users to drop off!
I can say that i know of at least two people who I've setup for and to date they have been enjoying the fairly maintenance free setup. (Pointswell and Eagles9999)
