Absolutely.

Meanwhile, we live in a world where VPNs are sold to the casual user while critical systems are left on internet facing networks.

I've never understood why, if these critical systems need remote access, it's not all done through a VPN of some sort. VPNs are not infallible, but it significantly increases the bar for entry from script kiddie to nation state real quick (depending on choice of crypt), while choosing a well supported implementation ensures long term bug fixes and security patches.