Had my sandbox as a VSC project. Now I refreshed, and obviously the authentication is failing. I could create a new project, but is this the correct way?
Conceptually, authorizing an org and setting the default org for a project are separate things. You can authorize the refreshed sandbox, and reuse the existing alias, and it will remain the default org for any projects where it was designated as such.
In VS Code, just use the SFDX: Authorize an Org command and use the same alias when prompted. This command sets it as the default org for the current project. From the command line, it's
sfdx force:auth:web:login -r https://test.salesforce.com -a [existing alias name]
Whether you use a new project or not depends on what you want to do with the metadata in the project. If you want to deploy work-in-progress from the project to the refreshed sandbox, then you could use the same project. If the work-in-progress is in source control, then a new project might or might not be in order.
Even in the org-based development model, the vision with sfdx is to have the source control be the "source of truth," detached from any specific org's metadata. . Where you are on the journey towards that goal will drive how you manage metadata on your local drive (ie, the VS Code project) and in the orgs.