Besides structuring the software, what does building an application in DMZ layers or zones give the cyber security architect?

It lets the security architect name the allowed actors, actions and services for each zone and formulate clear rules based on them.

A zone is a statement of intent: "only the WAF talks to the internet", "only the web server talks to the database", "only the data-transfer service talks to the backend". Once the software is cut into such zones, each of those statements becomes a firewall rule, a filter, or a gateway policy, and anything not on the list is denied. Without zones, the architect is left writing rules for one big mixed network, where it is hard to say who should talk to whom, and "allow any" creeps in. So the same layering that helps developers structure the code also turns security from guesswork into a short, reviewable rule set.

Go deeper:

• NIST SP 800-41 Rev. 1 — Guidelines on Firewalls and Firewall Policy — turning a zone design into a deny-by-default rule set.