I'm a systems engineer who specializes in endpoint management and security. Many organizations have stopped letting end users install VPN clients on their personal devices, because yes, they are a pretty common vector for malware and virus transmission. Think about it for a sec. When you allow a user to VPN into your network, you're allowing a PC or device that may be fucking corrupt as all hell into your INTERNAL network. That's a horrible security posture to assume. Pretty fucking stupid really.

At my last shop we ONLY allowed folks to connect on personal devices, and then connect to our terminal services environment. They could NOT open up the intranet on their own computer, they could NOT access file shares, they could NOT use Outlook Web Access, nothing. They could run a TS client and connect to our TS servers. That's it. The problem is folks don't really like working via TS/remotely. They want to be able to work on that big-ass spreadsheet, locally, even if they have no connectivity.

So not many folks wanted to use our VPN-TS client. That was fine, they got a laptop if they really had to work on the road or from home anyway.

Before I left i was testing a remote VPN solution that would allow a user to plug in a USB thumb drive, that had stored on it a Virtual Machine that was encrypted, and locked down by us. That VM was also updated, the user ran with his regular work credentials without any admin access, and no, they couldn't access the VM via any pre-boot hacks to change their permissions or password. If the user somehow DID manage to hack the environment, it had the equivalent of a checksum, and couldn't connect.