I don't think I get this argumentation. VPNs are easy to use these days so there's no "physically at our office" angle imho. The VPN adds a zone that the client

I don't think I get this argumentation. VPNs are easy to use these days so there's no "physically at our office" angle imho. The VPN adds a zone that the client can trust (which should not entail your whole internal network being exposed to it but I've never seen that anywhere to be quite honest). They get their Windows/AV/whatnot updates from that, connect to the services they need on the road. Simultaneously the VPN shields said services in a managable way, though that's more of a on-premise vs. cloud discussion I feel like, with the VPN being the way to get access to the on-premise stuff if you do not happen to be in the office. Maybe I'm missing your alternative? VPNs have some upsides over, say, a reverse proxy for that use case (weird sales clients for example that talk TCP, not HTTPS) in the setups I've seen. It also prevents exposure to the exact scenario we see in this very thread. Finding public instances of popular software is easy, enabling drive-by exposure to vulnerabilities. Putting them behind a proxy/VPN at least provides a hurdle for non-targeted attacks from my point of view.