This is one of my favorite posts to give a picture of the the reason a VPN should not be required (and a lot more). Perhaps some details have shifted on implementation, but the overview is accurate picture: