Bearing in mind that all AWS Lambda to AWS Service calls are HTTPS anyways, it depends on how scared you are of the internet.
By default, all AWS APIs (like the ones the SDKs use) exist on the internet. By using VPC endpoints you can force these calls over AWS backbone network and steer clear of the internet all together. A VPC endpoint only allows traffic from a particular VPC to a particular service, e.g. a Lambda attached to a VPC uses a VPC endpoint to call DynamoDB without traversing the internet.
You can create IAM Roles that allow access to an AWS service, but are only valid when the traffic is coming from a particular VPC. This DOES NOT turn off those AWS APIs on the internet. You can't stop a user coming in through the internet with an IAM role that gives access to the AWS service being called, if that role does not specify a VPC.
S3 Bucket Policies can limit access to individual VPCs, so someone coming in through the internet may not be able to access the contents of an S3 bucket (regardless of IAM role), they could however still delete it (if they had access to an IAM role allowing such an action).
Lastly, by removing all internet access from a Lambda, you can make it more difficult to run injection attacks against it, as they often involve forcing a Lambda to download (and then run) arbitrary code from the internet.