Often attacks like this involve first getting on the VPN (leaked creds, a n-day on a web-accessible endpoint, etc) then running wild on the internal services that everyone assumes are safe.
"I won't lock the door coz attackers might be able to bring battering ram"
you can just walk into any store, find ANY PC and stick your USB drive into it.
or find any exposed Ethernet slot and slide your device in it.
most of the time it will work and you will get an inside access.
publicly available retail stores require multiple layers of defense across the L7 stack
this sounds like a great premise for a xkcd
Sure, you should also keep them up to date, but if they're on the internet you're screwed as soon as someone finds an exploit and runs it against everything on shodan. On a VPN there at least need to be two big problems.
It probably is. It's not some web api. These things are usually designed for someone to use a remote desktop type system and/or VPN to access a LAN only web app running on a windows 2008 VM on a 10 year old tower server running VMware 6 in the utility room. Maybe these days there is a cloud portal they can access that has metrics and stuff. I see no indication in the article that this some exposed web app/API webpage.