Often attacks like this involve first getting on the VPN (leaked creds, a n-day on a web-accessible endpoint, etc) then running wild on the internal services that everyone assumes are safe.
or find any exposed Ethernet slot and slide your device in it.
most of the time it will work and you will get an inside access.
publicly available retail stores require multiple layers of defense across the L7 stack