Jumphosts aks Bastion servers are part of the "security by obsecurity" approach, they are usually part of the infrastructure but outside of the assumed attach vector. For your example of using webhosts, all webhosts would only accept requests via a list of specific servers, webhosts are easily found on the internet as they expose ports and host services, like a website. The Jumpbox's only purpose is to provide access to those webhosts, and does NOT offer any public services.
Additionally, jumpboxes are usually more secure with Multi-Factor Authentication in forms of Google Auth/Password/Kerberos Ticket/One Time Password/CAC, etc etc. Also typically webservers should not have internet access and are not directly accessible via the internet (only behind a load balancer) so you NEED a jump box to access them.
Other examples would be using a dial-up modem to access a router, out of band access using a phone number that isn't listed on the company contact page.
See more questions about bastion hosts on SecurityExchange