Second, getting a dump of a table from your MySQL DB with SSH+keys:
ssh prod-db
mysqldump what-i-need > file.sql
exit
scp prod-db:file.sql .
With VPN (assuming the connection is running): mysqldump -h prod-db whatever > file.sql
(I'm not saying it's neccesarily a good idea to du dumps of your production db, but that was the example that came to mind.)There's also stuff like instrumenting a running Tomcat with JVisualVM on a server in your remote environment (which, no, you can't easily do over SSH-forwarded ports.. also, portforwarding is annoying).
Finally, VPN allows you to run internal services. A jabber-server was mentioned in the article, and perhaps a webserver with some reports/dashboard thing, cacti/nagios stuff etc. without worrying about setting up authentication and SSL for each. Each VPN user gets his own IP, so you can just do crude IP allow/deny if you need, or you can put the customer people on one subnet and allow them to access the reports server, and the devs/ops on another that can reach everything.