Currently at one of the top 5 global audit and consulting firms, 300.000+ employees worldwide, and we are perfectly compliant with split tunneling VPN in more than 50 operating countries with their own legal restrictions. Sure, some clients are only accessible through all sort of hoops and Citrix or CyberArk or even customer's hardened laptops (like governmental clients) but there are better security tools today than the dated concept of tunneling everything through the intranet.

Previous company, also Fortune 100 manufacturer of fast moving consumer goods with GxP and SOX compliance requirements, switched to split tunnel some 15+ years ago and is still doing just fine from a compliance perspective.

At the same time I have at this time a client with GxP, HIPAA and other requirements like special.governmental audits because if they fail they can drag down a significant piece of the economy of one of the big developed nations. And these guys interpreted the compliance requirements as "do not ever update or patch a server or we have to spend another 6 months requalifying the infrastructure and revalidating the applications", which is one of the dumbest interpretations I have ever heard (and in consulting I hear and see a lot of wtf's). But hey, they're happy with "legacy" operating systems and somehow their auditors are still recertifying them, so...