The government's point here is that qualified people should be writing those intranet tools. It is no longer ok to write insecure janky software because "don't

The government's point here is that qualified people should be writing those intranet tools. It is no longer ok to write insecure janky software because "don't worry we can secure later by putting it behind a VPN/Firewall". That is fixing bad engineering with duck tape. The correct approach is to engineer it correctly. Write your software as if it was going to be directly exposed to the internet. While VPNs do provide protection, they do not provide sufficient protection. If software isn't safe to use without a VPN, it isn't safe to use with a VPN either.