This is not always the case, split-tunneling is a standard config option. I setup my clients this way most of the time. Only, corporate assets get the client and they are checked for a/v and firewall on connection.