Except that a VPN endpoint is a public facing service, which might get exploited with a 0-day. And that "internal services" more often than not are reachable vi

Except that a VPN endpoint is a public facing service, which might get exploited with a 0-day. And that "internal services" more often than not are reachable via HTML email or just web browsers on the inside, which might be used to exploit your "internal service" with a 0-day.