It's fairly typical, this. The world and his wife hears 'VPN' through the myriad of advertising vectors they're bombarded with and assume the advertised use case is the only use case.
The 'P' in VPN is what confuses them I assume.
assume everything in the internal network is compromised already. the moat and castle model is dead.